|
If you are an active Metabase user, we have important information to share about a recent security incident. (If you were interested in Metabase in the past, but are not using it, you can disregard this message.)
We recently identified that Metabase Cloud was attacked by someone utilizing an unknown (“0-day”) security vulnerability in versions 1.58 and above. We immediately blocked the endpoints used for the attack, then quickly identified and patched the vulnerability.
If you are a Metabase Cloud customer, your instance is already upgraded and patched against this vulnerability.
If you are self-hosting Metabase, your instance of Metabase may be vulnerable. After gaining access to your instance, the attacker could inject arbitrary SQL against the Metabase application database, which can give them administrator access to the instance. From there, the attacker could change your application configuration, steal stored credentials for your connected databases, read any data accessible through those connections, and export data.
We recommend you immediately upgrade to the latest point release of the version you are running and take the following steps
Immediate steps to take
If the /api/session/reset_password endpoint of your Metabase instance is publicly accessible then please do the following after you upgrade
-
revoke all active user sessions by accessing the Metabase Application Database and TRUNCATE TABLE core_session
-
review your API keys and delete any unrecognized keys
-
review administrator accounts for any unexpected changes
-
rotate credentials for any of the connected databases
-
review data warehouse logs for any sign of unauthorized access
-
review Metabase activity and query history for unexpected or unauthorized activity
Attack pattern
The pattern of attack looks like the following:
If you find that pattern in your application logs or in your Metabase server ingress logs, it is likely that your instance has been compromised.
Upgrade instructions
See the list of versions below and find the latest point version for the Metabase version you're running. If you're running a point version below that version, you are still vulnerable and should upgrade.
For example, if you are running 0.58.6, you should upgrade to 0.58.24 release or later. If you’re running a version of Metabase below version 58, you are not vulnerable.. You can find your current version by clicking on the "gear" or “grid” icon in the upper right and selecting "About Metabase” or “Help > About Metabase”, depending on your version.
Minimum safe releases for each Metabase version
The downloads below include the minimum safe release for each Metabase version.
63
0.63.5
Docker image: metabase/metabase:v0.63.5
Download the JAR here: https://downloads.metabase.com/v0.63.5/metabase.jar
62
0.62.9
Docker image: metabase/metabase:v0.62.9
Download the JAR here: https://downloads.metabase.com/v0.62.9/metabase.jar
61
0.61.11
Docker image: metabase/metabase:v0.61.11
Download the JAR here: https://downloads.metabase.com/v0.61.11/metabase.jar
60
0.60.17
Docker image: metabase/metabase:v0.60.17
Download the JAR here: https://downloads.metabase.com/v0.60.17/metabase.jar
59
0.59.21
Docker image: metabase/metabase:v0.59.21
Download the JAR here: https://downloads.metabase.com/v0.59.21/metabase.jar
58
0.58.24
Docker image: metabase/metabase:v0.58.24
Download the JAR here: https://downloads.metabase.com/v0.58.24/metabase.jar
Workaround: temporarily block the affected endpoint
If you are unable to upgrade ASAP, as a temporary workaround, block the /api/session/reset_password endpoint.
Thank you,
Sameer Al-Sakran
Founder and CEO
Metabase
|
