/
← Voltar ao feed
high

Metabase Enterprise CVE-2026-33725: Authenticated Admin RCE via H2 JDBC INIT Injection in Serialization Import, Public PoC Released

1 fonte(s) · 1 atualização(ões) · publicado 05/05/2026 16:51 · coletado há 4 dias

A high-severity vulnerability, CVE-2026-33725 (CVSS v3.1 7.2), affects Metabase Enterprise and allows an authenticated administrator to achieve remote command execution. It was discovered by Hacktron AI and Rahul Maini. The flaw lies in the /api/ee/serialization/import route, where the subname field of an imported YAML is concatenated unsanitized into the JDBC connection string. The Hakai Pentest team published a technical analysis and a PoC on GitHub that yields a reverse shell. The article does not report in-the-wild exploitation.

Detalhes técnicos

  • The import route accepts a .tar.gz containing YAML that defines a new database (name, engine, details). With the H2 engine, the unsanitized subname lets an attacker inject the INIT parameter, which runs arbitrary SQL when the connection is established.
  • The connection is forced by triggering the database sync in the admin panel.
  • Step 1: the H2 CSVWRITE function writes an arbitrary file to disk, here a Clojure payload (/tmp/.poc_*.clj). Column header and delimiter options are set so the output is valid code.
  • Step 2: the payload uses clojure.java.shell/sh to run /bin/sh -c. Characters are built with str and backslash-escaped literals to avoid quote-escaping problems.
  • Step 3: CREATE ALIAS ... FOR "clojure.lang.Compiler.loadFile" followed by CALL LOADCLJ(...) loads and executes the written file at runtime, giving command execution (demonstrated with whoami).

Remediação

  • Update Metabase to the latest patched version (see advisory GHSA-fppj-vcm3-w229).
  • If an immediate update is not possible, disable the /api/ee/serialization/import route as a workaround.
  • Restrict and audit administrator accounts, since exploitation requires admin privileges.

Linha do tempo

  1. yokai.hakaisecurity.io ↗ · pub. 05/05/2026 16:51 · coletado 19/10 18:03 primeiro registro

    Metabase Enterprise CVE-2026-33725: Authenticated Admin RCE via H2 JDBC INIT Injection in Serialization Import, Public PoC Released

    ler a análise desta fonte

    A high-severity vulnerability, CVE-2026-33725 (CVSS v3.1 7.2), affects Metabase Enterprise and allows an authenticated administrator to achieve remote command execution. It was discovered by Hacktron AI and Rahul Maini. The flaw lies in the /api/ee/serialization/import route, where the subname field of an imported YAML is concatenated unsanitized into the JDBC connection string. The Hakai Pentest team published a technical analysis and a PoC on GitHub that yields a reverse shell. The article does not report in-the-wild exploitation.

    Technical Details

    • The import route accepts a .tar.gz containing YAML that defines a new database (name, engine, details). With the H2 engine, the unsanitized subname lets an attacker inject the INIT parameter, which runs arbitrary SQL when the connection is established.
    • The connection is forced by triggering the database sync in the admin panel.
    • Step 1: the H2 CSVWRITE function writes an arbitrary file to disk, here a Clojure payload (/tmp/.poc_*.clj). Column header and delimiter options are set so the output is valid code.
    • Step 2: the payload uses clojure.java.shell/sh to run /bin/sh -c. Characters are built with str and backslash-escaped literals to avoid quote-escaping problems.
    • Step 3: CREATE ALIAS ... FOR "clojure.lang.Compiler.loadFile" followed by CALL LOADCLJ(...) loads and executes the written file at runtime, giving command execution (demonstrated with whoami).

    Remediation

    • Update Metabase to the latest patched version (see advisory GHSA-fppj-vcm3-w229).
    • If an immediate update is not possible, disable the /api/ee/serialization/import route as a workaround.
    • Restrict and audit administrator accounts, since exploitation requires admin privileges.