CVE-2021-41277 Scanner
Detects 'Local File Inclusion (LFI)' vulnerability in Metabase affects v. 0.x before 0.40.5 and 1.x before 1.40.5.
Short Info
Level
High
Single Scan
Single Scan
Can be used by
Asset Owner
Estimated Time
10 seconds
Time Interval
1 month 1 day
Scan only one
URL
Toolbox
-
Metabase is a popular open source data analytics platform that enables individuals and organizations to easily make sense of complex data by creating custom dashboards and reports. It is designed to provide access to data from a variety of sources, including spreadsheets, databases, APIs, and AWS services. The platform is used by businesses of all sizes, from small startups to large enterprises, as well as individuals who want to better understand their personal data.
CVE-2021-41277 is a recently discovered security vulnerability in Metabase that affects the custom GeoJSON map feature. The vulnerability has been found in all versions of Metabase prior to the latest maintenance release (0.40.5 and 1.40.5). It arises from a failure to properly validate URLs before loading them, which can result in local file inclusion, including environment variables. This could allow a malicious actor to access sensitive information or execute malicious code on the affected system.
If exploited, this vulnerability can lead to significant security breaches, including data theft and system compromise. Attackers could potentially gain access to sensitive data, such as user credentials or proprietary information. In addition, they could use the system to launch additional attacks against other systems on the same network.
As an added benefit, the pro features of the s4e.io platform can help individuals and organizations quickly and easily identify vulnerabilities in their digital assets. By providing advanced scanning and analysis capabilities, this platform allows users to stay one step ahead of potential security threats and protect their valuable data. By emphasizing the importance of proactively addressing security vulnerabilities like CVE-2021-41277, organizations can ensure the ongoing safety and security of their digital assets.
REFERENCES
