CVE-2024-28848
Published: 15 March 2024
Summary
CVE-2024-28848 is a high-severity Code Injection (CWE-94) vulnerability in Open-Metadata Openmetadata. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 0.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
OpenMetadata, a metadata platform for data discovery and governance, contains a critical expression language injection vulnerability in the CompiledRule::validateExpression method. This component uses a StandardEvaluationContext to evaluate user-supplied SpEL expressions without restriction, permitting direct access to classes such as java.lang.Runtime. The flaw is exposed through the unauthenticated-authorization path at /api/v1/policies/validation/condition/<expression>, which passes attacker-controlled input directly to the evaluator.
Any authenticated non-admin user can therefore submit crafted expressions that execute arbitrary system commands on the host operating system, resulting in full remote code execution. The absence of an Authorizer.authorize() call on this code path means the endpoint lacks the intended access control, allowing privilege escalation from a low-privileged account.
The vulnerability was fixed in OpenMetadata 1.2.4; the project advisory recommends immediate upgrade and states that no workarounds exist. The issue was identified via static analysis (CodeQL) and is tracked as GHSL-2023-236. The associated EPSS score reached 0.7862 without a subsequent material increase, indicating sustained but not sharply rising exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-1111
Vulnerability details
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `CompiledRule::validateExpression` method evaluates an SpEL expression using an `StandardEvaluationContext`, allowing the expression to reach and interact with…
more
Java classes such as `java.lang.Runtime`, leading to Remote Code Execution. The `/api/v1/policies/validation/condition/<expression>` endpoint passes user-controlled data `CompiledRule::validateExpession` allowing authenticated (non-admin) users to execute arbitrary system commands on the underlaying operating system. In addition, there is a missing authorization check since `Authorizer.authorize()` is never called in the affected path and therefore any authenticated non-admin user is able to trigger this endpoint and evaluate arbitrary SpEL expressions leading to arbitrary command execution. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-236`. This issue may lead to Remote Code Execution and has been resolved in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Makes persistent code injection into loaded programs impossible when the executable image itself resides on hardware-protected read-only media.
Dynamically generated code can be produced and executed inside the isolated chamber, preventing host compromise from code-injection payloads.
Validates inputs used in dynamic code generation to block injected directives.
Directly prevents execution of attacker-supplied code written into data memory regions.