Clojure
Monthly
Server-side request forgery in Metabase through 0.63.18 lets an attacker bypass GeoJSON URL validation by saving a custom GeoJSON entry that points at the unspecified address 0.0.0.0, which resolves to loopback and causes the Metabase server to fetch from services bound to localhost and return their responses to the caller. Note a conflict in the source data: vendor scoring (CVSS 4.0 with PR:H) requires high-privileged, authenticated access to persist the malicious GeoJSON entry, while the CVE description asserts that the triggered read is returned to unauthenticated callers - the authentication bar for triggering and reading should be verified against the vendor advisory. Publicly available exploit code exists (VulnCheck advisory and a public write-up), there is no CISA KEV listing indicating confirmed active exploitation at time of analysis, and impact is confidentiality-only, since only response data is exposed with no integrity or availability effect.
Server-side request forgery in Metabase through 0.63.18 lets an attacker bypass GeoJSON URL validation by saving a custom GeoJSON entry that points at the unspecified address 0.0.0.0, which resolves to loopback and causes the Metabase server to fetch from services bound to localhost and return their responses to the caller. Note a conflict in the source data: vendor scoring (CVSS 4.0 with PR:H) requires high-privileged, authenticated access to persist the malicious GeoJSON entry, while the CVE description asserts that the triggered read is returned to unauthenticated callers - the authentication bar for triggering and reading should be verified against the vendor advisory. Publicly available exploit code exists (VulnCheck advisory and a public write-up), there is no CISA KEV listing indicating confirmed active exploitation at time of analysis, and impact is confidentiality-only, since only response data is exposed with no integrity or availability effect.