This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis β
Q1What is this vulnerability? (Essence + Consequences)
π¨ **Essence**: OpenMetadata < 1.2.4 has a **SpEL Injection** flaw in `GET /api/v1/policies/validation/condition/`. π **Consequences**: Attackers can execute **Remote Code Execution (RCE)** on the server.β¦
π‘οΈ **Root Cause**: **CWE-94** (Code Injection). The vulnerability stems from unsafe handling of Spring Expression Language (SpEL) in `CompiledRule.java`. β οΈ User input is likely evaluated directly without sanitization.
π» **Attacker Actions**: Full **Remote Code Execution**. π΅οΈββοΈ Can access sensitive data, modify system state, and compromise the entire infrastructure. CVSS Score indicates **High** impact across all metrics.
Q5Is exploitation threshold high? (Auth/Config)
π **Threshold**: **Low**. π Network Accessible (AV:N). βοΈ Requires **Low Privileges** (PR:L) but **No User Interaction** (UI:N). π« Authentication is likely required, but the bar is low.
Q6Is there a public Exp? (PoC/Wild Exploitation)
π§ͺ **Public Exploit**: **No**. π The `pocs` array is empty in the data. π« No known wild exploitation or public PoC provided in this dataset.
Q7How to self-check? (Features/Scanning)
π **Self-Check**: Scan for OpenMetadata instances. π΅οΈββοΈ Check if version is **< 1.2.4**. π‘ Monitor API calls to `/api/v1/policies/validation/condition/` for SpEL payloads (e.g., `T(java.lang.Runtime)...`).
Q8Is it fixed officially? (Patch/Mitigation)
β **Fixed**: **Yes**. π οΈ Upgrade to **OpenMetadata 1.2.4** or later. π Official advisory: GHSA-5xv3-fm7g-865r. π See GitHub source links for details.
Q9What if no patch? (Workaround)
π§ **No Patch?**: Implement **WAF rules** to block SpEL syntax in API parameters. π Restrict access to the `/policies/validation/condition/` endpoint. 𧱠Input validation at the application layer.
Q10Is it urgent? (Priority Suggestion)
π₯ **Urgency**: **CRITICAL**. π¨ CVSS Vector: `AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`. πββοΈ Immediate patching recommended due to RCE risk and low exploitation barrier.