Skip to content
Fencer Vulns
critical 9.8

CVE-2024-28255 in the critical feed json

Authentication Bypass in OpenMetadata

published 2024-03-15 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-25354

cvss
9.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
73.3%
EPSS 73.3% chance of exploitation in 30 days, percentile 99.4%
public exploits
1
Metasploit, plus a Nuclei check

Summary

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.

Patch / fix

  • openmetadata openmetadata 1.2.4

Timeline

  1. First public exploit (Metasploit exploit/linux/http/openmetadata_auth_bypass_rce)
  2. Published

CISA SSVC

Exploitation
Proof of concept is public
Automatable
yes
Technical impact
total
Assessed
2 y ago

Exploit prediction

73.26% chance of exploitation in the next 30 days, higher than 99.4% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/linux/http/openmetadata_auth_bypass_rce OpenMetadata authentication bypass and SpEL injection exploit chain metasploit exploit, excellent rank, 2024-03-15
  • Nuclei template OpenMetadata - Authentication Bypass nuclei detection template
  • github.com https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-6wx7-qw5p-wh84 referenced PoC, tagged "exploit" by a source, unverified
  • vicarius.io https://www.vicarius.io/vsociety/posts/authentication-bypass-with-path-parameter-in-openmetadata-cve-2024-28255 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected products

  • open-metadata OpenMetadata
  • openmetadata openmetadata

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.