Security update available for Metabase - Please upgrade now

Metabase | Open source Business Intelligence and Embedded Analytics

3 min read Original article ↗

If you are an active Metabase user, we have important information to share about a recent security incident.

We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability.

If you are a Metabase Cloud customer, your instance is already upgraded and patched against this vulnerability.

If you are self-hosting Metabase, your instance of Metabase may be vulnerable. After gaining access to your instance, the attacker could inject arbitrary SQL against the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change your application configuration, steal stored credentials for your connected databases, read any data accessible through those connections, and export data.

For more information, see the security advisory.

We recommend you immediately upgrade to the latest point release of the version you are running and take the following steps.

If the /api/session/reset_password endpoint of your Metabase instance is publicly accessible then please do the following after you upgrade:

  • revoke all active user sessions by accessing the Metabase Application Database and deleting all rows in the core_session table
  • review your API keys and delete any unrecognized keys
  • review administrator accounts for any unexpected changes
  • rotate credentials for any of the connected databases
  • review data warehouse logs for any sign of unauthorized access
  • review Metabase activity and query history for unexpected or unauthorized activity

Attack pattern

The pattern of attack looks like the following:

  • call to POST /api/session/reset_password with a 400 status code followed by
  • call to GET /api/user/current with a 200 status code

If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised.

Upgrade instructions

See the list of versions below and find the latest point version for the Metabase version you’re running. If you’re running a point version below that version, you are still vulnerable and should upgrade.

For example, if you are running 0.58.6, you should upgrade to 0.58.24 release or later. If you’re running a version of Metabase below version 58, you are not vulnerable.. You can find your current version by clicking on the “gear” or “grid” icon in the upper right and selecting “About Metabase” or “Help > About Metabase”, depending on your version.

The downloads below include the minimum safe release for each Metabase version.

63

0.63.5

62

0.62.9

61

0.61.11

60

0.60.17

59

0.59.21

58

0.58.24

Workaround: temporarily block the affected endpoint

If you are unable to upgrade ASAP, as a temporary workaround, block the /api/session/reset_password endpoint.