Description
Metabase through 0.63.18 fails to properly validate the unspecified address 0.0.0.0 in custom GeoJSON URLs, allowing unauthenticated attackers to reach loopback services. Attackers can save a malicious GeoJSON entry with 0.0.0.0 and trigger requests that return loopback service responses to unauthenticated callers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| metabase | Metabase | ≤ 0.63.18 | — |
References
- Researcher write-up, finding 2 technical-description exploit
- the resolver rejects only link-local addresses technical-description
- https://github.com/metabase/metabase product
- VulnCheck Advisory: Metabase through 0.63.18 SSRF via GeoJSON URL validation bypass third-party-advisory