# CVE-2021-41277: Metabase - Local File Inclusion

> Live exploitation tracking for CVE-2021-41277 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2021-41277

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 10.0
- **Public exploit available:** Yes
- **Affected products:** Metabase
- **Weaknesses:** CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor); CWE-22 (Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'))
- **Tags:** web_application

## Description

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

## CrowdSec analysis

[CVE-2021-41277](https://euvd.enisa.europa.eu/vulnerability/CVE-2021-41277) is a critical vulnerability in Metabase that enables attackers to conduct unauthenticated local file inclusion by leveraging improperly validated custom GeoJSON map URLs.

CrowdSec has been tracking this vulnerability and its exploits since 27th of November 2024.

Insights from the CrowdSec network reveal that the attackers trying to exploit CVE-2021-41277 are composed of a fairly even mix of opportunistic and targeted actors. Some attackers employ preliminary reconnaissance, while others use indiscriminate scanning.
CrowdSec network telemetry also shows that exploitation of CVE-2021-41277 has significantly declined over the past week. Attack volumes are well below the long-term average, suggesting attackers are rapidly losing interest. The vulnerability appears to be falling out of active use across most threat landscapes.

Exploitation attempts are notably identified through requests to URLs containing `/api/geojson?url=file:///etc/passwd`.

## Timeline

- 2021-11-17: CVE Published. CVE-2021-41277 is published to NVD.
- 2024-11-12: CISA KEV. CVE-2021-41277 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2024-11-27: Rule Released. CrowdSec releases a rule to detect CVE-2021-41277 exploitation attempts against the CrowdSec Network.
- 2024-11-27: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2021-41277 for the first time.
- 2024-12-03: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr
- https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41277.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2021-41277) follows observed exploitation activity for CVE-2021-41277. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.