Metabase SQL Injection and Command Injection Analysis (CVE-2018-12464/12465)

Critical Vulnerability Information 1. SQL Injection Everywhere! Choose Wisely Description: Multiple SQL injection vulnerabilities exist, with one prominent SQL injection issue located in a publicly accessible endpoint. Code Example: Impact: Attackers can exploit the SQL injection vulnerability by manipulating dynamically generated PostgreSQL connection parameters, enabling them to execute arbitrary SQL queries. 2. Stacked Queries Enabled Description: Stacked query functionality is enabled, which may lead to security issues under certain conditions. Code Example: Stacked queries allow multiple SQL statements to be executed within a single request, potentially leading to SQL injection attacks. Impact: Attackers can leverage this feature to bypass authentication mechanisms or even perform arbitrary operations. 3. Authenticated Command Injection Description: An authenticated command injection vulnerability exists, with the affected code segment accessible only to users with specific privileges. Code Example: Impact: Attackers can execute operating system commands under specific privilege conditions, potentially escalating privileges or accessing sensitive information. 4. Metasploit Module Description: A Metasploit module has been discovered that exploits the aforementioned vulnerabilities. Link: https://github.com/rapid7/metasploit-framework/pull/10255 Impact: The development and release of this module automate exploitation, facilitating penetration testing and vulnerability validation. 5. Timeline Key Events: - 2018-06-19: Discovery of 0day vulnerability. - 2018-06-20: Module implementation and testing. - 2018-06-21: Initial contact with vendor. - 2018-06-22: Vendor response. - 2018-06-27: Vendor releases CVE-2018-12464 and CVE-2018-12465 patches.

Goal Reached Thanks to every supporter — we hit 100%!

Metabase SQL Injection and Command Injection Analysis (CVE-2018-12464/12465)