OpenMetadata is a unified platform for data discovery, observability, and governance, widely used by data engineers, analysts, and scientists to manage metadata across organizations. It provides a central metadata repository, lineage tracking, and collaboration features, integrating with various data tools to ensure data quality and compliance.
CVE-2024-28255 is a critical unauthorized admin access vulnerability in OpenMetadata versions 1.2.3 and earlier. It arises from improper JWT validation in the JwtFilter component, which fails to properly handle path parameters, allowing attackers to bypass authentication mechanisms.
Specifically, the vulnerability targets the JwtFilter's handling of path parameters in API requests. By crafting a request like GET /api/v1;v1%2fusers%2flogin/events/subscri, an attacker can manipulate the path to include arbitrary strings, bypassing JWT validation for excluded endpoints and gaining unauthorized access.
If exploited, an attacker can gain full administrative access to the OpenMetadata instance, leading to data breaches, unauthorized modifications, and potential compromise of the entire metadata infrastructure. This can severely impact data governance and compliance efforts.
- Upgrade OpenMetadata to version 1.2.4 or later to patch the vulnerability.
- Implement strict input validation and sanitization for all API path parameters.
- Regularly review and update JWT validation logic to prevent bypass techniques.
- Monitor access logs for suspicious requests containing path parameter manipulations.
- Conduct regular security assessments and penetration testing on OpenMetadata deployments.
- Apply the principle of least privilege to all user accounts and API endpoints.
- Enable detailed logging and alerting for authentication failures and unusual access patterns.
- Consider using a web application firewall (WAF) to filter malicious requests targeting path parameters.
Get AI-powered remediation steps tailored to your asset.
Try AI Solutions →