ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2021-41277

KEVlarge

Unauthenticated Local File Inclusion in Metabase GeoJSON Map API

CISA: Metabase GeoJSON API Local File Inclusion Vulnerability

CVSS 3.1
7.5 high
EPSS
97%p100
Published
()
KEV added
AI analysis

Metabase, an open source data analytics and business intelligence platform, does not validate URLs supplied to its custom GeoJSON map feature, resulting in a local file inclusion flaw (CWE-22/CWE-200). A remote, unauthenticated attacker can abuse the GeoJSON API to read arbitrary files on the Metabase server, including environment variables that frequently contain database credentials and API keys. Any organization running an affected Metabase release with the application reachable by attackers is exposed; the CVSS vector (AV:N/PR:N, C:H) reflects unauthenticated network exploitation with high confidentiality impact. Exploitation is confirmed in the wild: the flaw carries a 97.2% EPSS score (100th percentile) and was added to CISA's Known Exploited Vulnerabilities catalog on 2024-11-12, though no public proof-of-concept is catalogued in the available data.

What to do: Upgrade Metabase to 0.40.5 (open source) or 1.40.5 (enterprise) or any later release. If upgrading immediately is not possible, add URL-validation rules on your reverse proxy, load balancer, or WAF to filter requests to the GeoJSON API. Audit environment variables on Metabase hosts for sensitive secrets and review access logs for unexpected GeoJSON API requests, rotating any exposed credentials as a precaution.

Affected
Metabase (open source edition)all releases prior to 0.40.5
Metabase (enterprise edition)all releases prior to 1.40.5
Estimated exposure
largeon the order of ~10,000-20,000 internet-exposed Metabase instances per public scans, with total self-hosted deployments likely higher — Metabase is a widely self-hosted open source BI platform and public internet-wide scans (e.g., Shodan) typically surface on the order of tens of thousands of exposed instances, so this is an estimate and the full install base is unknown.

Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.

Description

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

CISA Known Exploited Vulnerability
Affected
Metabase Metabase
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Due date
Ransomware use
Unknown
Vendors
metabase
Products
metabase
Weakness
CWE-200, CWE-22
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NVD CVE.org CISA KEV GitHub PoCs EPSS (97.2%)

In the news