Metabase - Local File Inclusion (CVE-2021-41277)
Description
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (admin->settings->maps->custom maps->add a map) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
psychologyCrowdSec Analysis
CVE-2021-41277 is a critical vulnerability in Metabase that enables attackers to conduct unauthenticated local file inclusion by leveraging improperly validated custom GeoJSON map URLs.
CrowdSec has been tracking this vulnerability and its exploits since 27th of November 2024.
Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2021-41277 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning. CrowdSec network telemetry also shows that exploitation of CVE-2021-41277 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.
Exploitation attempts are notably identified through requests to URLs containing /api/geojson?url=file:///etc/passwd.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2021-11-17 |
| CISA KEV | 2024-11-12 |
| Rule Released | 2024-11-27 |
| CrowdSec First Seen | 2024-11-27 |
| CISA Remediation Deadline | 2024-12-03 |
Related Weaknesses
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.