An attacker used a previously unknown flaw in Metabase to break into the company's hosted analytics service and copy data belonging to its customers. Laptop maker Framework and the form builder Tally have both told their users that personal details were taken.
Metabase went public with the incident on Thursday, August 6. It said someone had attacked Metabase Cloud through a zero day vulnerability present in versions 1.58 and above, and that it blocked the endpoints involved before finding and fixing the bug itself. Hosted customers were moved to patched builds automatically. Anyone running their own copy of the software has to upgrade by hand.
What the flaw allows
The bug is an SQL injection that needs no login. According to the advisory, a remote attacker can run SQL of their choosing against the database where Metabase keeps its own settings, and end up with administrator rights over the instance. From that position they can change its configuration, lift the stored credentials for every connected database, read whatever those connections can reach, and export it.
That last part is what makes this serious. Metabase is a business intelligence tool, and its whole purpose is to sit in front of a company's production databases so staff can run queries and build dashboards. Admin access to it is close to admin access to the data behind it.
No CVE number has been assigned so far. Metabase rates the issue critical, with the highest possible CVSS score of 10.0, and has confirmed that it was exploited before a patch existed.
Framework and Tally
Framework said in a notice to customers that Metabase contacted it on August 6 to say its instance had been vulnerable and that the attacker got in on August 3. The exposed records include full names, email addresses, phone numbers, billing and shipping addresses, company names and the IP addresses customers logged in from. For business accounts, VAT and EIN numbers and billing email addresses may also be included. Payment details and order records were not part of it, the company said, and it has rotated the credentials of the databases that were connected to Metabase.
Tally sent its own users a similar warning. Someone got into the analytics setup it runs on Metabase, also on August 3, and reached email addresses along with passwords stored as cryptographic hashes. Forms and the responses submitted to them are kept separately and were not touched, according to the company.
Neither company has said how many people are affected. Customers of both should expect phishing emails that use the stolen details to look convincing.
What self hosted users should do
Versions older than 58 are not affected. For everything newer, Metabase has published a minimum safe release per branch: 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9 and 0.63.5. Teams that cannot upgrade right away are told to block the /api/session/reset_password endpoint as a stopgap.
Upgrading is only the first step if that endpoint was reachable from the internet. Metabase also recommends the following:
- Revoke every active session. The way to do that is to empty the
core_sessiontable in the application database. - Review API keys and administrator accounts, and delete anything unfamiliar.
- Rotate the credentials of all connected databases.
- Go through data warehouse logs and Metabase query history for activity nobody on the team can explain.
There is a simple way to check for the attack itself. The pattern Metabase describes is a POST request to /api/session/reset_password that returns status 400, followed by a GET request to /api/user/current that returns 200. An instance whose logs show that sequence should be treated as compromised.
Metabase has not named whoever was behind the attack, and it has not said how many cloud instances were accessed.
