CVE-2024-28255 Scanner

OpenMetadata is a unified platform for data discovery, observability, and governance, widely used by data engineers, analysts, and scientists to manage metadata across organizations. It provides a central metadata repository, lineage tracking, and collaboration features, integrating with various data tools to ensure data quality and compliance.

CVE-2024-28255 is a critical unauthorized admin access vulnerability in OpenMetadata versions 1.2.3 and earlier. It arises from improper JWT validation in the JwtFilter component, which fails to properly handle path parameters, allowing attackers to bypass authentication mechanisms.

Specifically, the vulnerability targets the JwtFilter's handling of path parameters in API requests. By crafting a request like GET /api/v1;v1%2fusers%2flogin/events/subscri, an attacker can manipulate the path to include arbitrary strings, bypassing JWT validation for excluded endpoints and gaining unauthorized access.

If exploited, an attacker can gain full administrative access to the OpenMetadata instance, leading to data breaches, unauthorized modifications, and potential compromise of the entire metadata infrastructure. This can severely impact data governance and compliance efforts.