Critical Metabase SQL Injection Zero-Day Exploited in Data Breaches

A critical SQL injection vulnerability in Metabase was exploited in zero-day attacks, affecting versions 1.58 and above. The vulnerability allows unauthenticated remote attackers to gain administrator access to customer instances. Metabase confirmed that its Cloud SaaS platform was compromised, impacting customers including Framework and Tally. The vulnerability has a CVSS score of 10.0 and has been actively exploited, although no CVE identifier has been assigned yet. Metabase has patched the vulnerability for its Cloud customers and provided guidance for self-hosted installations. Organizations are urged to upgrade immediately and review their security configurations. The attacks can be identified through specific log patterns indicating compromise. Metabase recommends blocking the '/api/session/reset_password' endpoint as a temporary measure.

Key Points: • A critical SQL injection vulnerability in Metabase allows remote attackers administrator access. • The vulnerability affects versions 1.58 and above, with active exploitation confirmed. • Metabase has rolled out patches for Cloud customers and provided guidance for self-hosted users.