CVE-2022-39360

Executive Summary

CVE-2022-39360 is an authentication bypass vulnerability in Metabase, an open-source data visualization and business intelligence platform. Prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9, users provisioned via Single Sign-On (SSO) were able to initiate a password reset flow, potentially granting them direct access to Metabase without authenticating through the configured Identity Provider (IdP). This flaw undermines the integrity of SSO enforcement and can result in unauthorized access to sensitive business intelligence data, with a CVSS score of 6.5.

Technical Analysis

The vulnerability resides in Metabase's authentication and account recovery logic. Metabase supports multiple authentication mechanisms, including SSO integration via protocols such as SAML, JWT, or LDAP. When an organization enables SSO, the expectation is that the IdP is the sole authority for authentication — users should not be able to authenticate with local credentials or bypass the IdP.

The flaw arises from a failure to enforce this policy during the password reset workflow. Prior to the fix, the application allowed SSO-provisioned user accounts to submit a password reset request. When a user performed a password reset on an SSO-managed account, Metabase would generate a reset token and allow the user to set a new local password. Once the password was set, the account became dual-authenticated: the user could log in either via the legitimate SSO IdP flow OR directly via the local credentials (the newly reset password).

The security impact is significant. An attacker who has identified an SSO-enabled Metabase instance and knows the email address of a valid SSO user can initiate the password reset flow for that account. If the attacker has access to the associated email inbox (e.g., via a compromised mailbox, or if the reset notification is misdirected), they can complete the reset and establish persistent local credentials. Alternatively, a low-privileged user who legitimately has access to their own email could reset their own password and bypass the SSO policy, gaining access without IdP enforcement — which may enable access to resources beyond their intended authorization level or circumvent multi-factor authentication (MFA) enforced at the IdP.

The attack surface is the Metabase web application, specifically the account recovery and login endpoints. The vulnerability requires network access to the Metabase instance and knowledge of a valid SSO user identifier (typically an email address). No specific function names or URL paths are provided in the NVD description; however, the affected logic is within the password reset and authentication modules. The patch blocks password reset for all users who use SSO for their Metabase login, effectively closing the bypass vector.

Exploitation Scenarios

No public PoC is available for this vulnerability; the attack chain is inferred from the vulnerability class (authorization bypass via insecure account recovery).

1) Reconnaissance and Target Identification: An attacker identifies a Metabase instance exposed to the internet or accessible on a corporate network. This can be done via Shodan using dorks such as http.title:"Metabase" or product:"Metabase", or by identifying the default port. The attacker then determines whether the instance is configured with SSO — this may be observable by attempting to access the login page and noting the presence of an SSO redirect button or by enumerating the application.

2) Triggering the Flaw: The attacker obtains the email address of a valid SSO user (e.g., from OSINT, corporate email patterns, or user enumeration via the login/reset endpoints). The attacker then initiates the password reset flow for that account, submitting the target email address to the password reset form.

3) Execution Method: The application, in vulnerable versions, generates a password reset token and emails the user (in a real attack, the attacker must have access to the inbox; in an insider-threat scenario, the legitimate user can perform this step themselves). The attacker clicks the reset link and sets a new password for the SSO-managed account. Critically, the application does not verify that the account is SSO-managed and does not block the reset.

4) Post-Exploitation Impact: After setting the local password, the attacker (or insider) authenticates directly to Metabase using the new credentials, bypassing the IdP entirely. This circumvents any MFA or conditional access policies enforced by the IdP. The attacker gains access to the Metabase instance with the privileges of the compromised account — potentially including access to sensitive dashboards, data visualizations, and underlying data sources connected to Metabase. The attacker can then exfiltrate data, pivot to connected databases, or use the access to conduct further reconnaissance on the organization's data infrastructure.

Impact Assessment

Business Impact: Successful exploitation of CVE-2022-39360 can lead to unauthorized access to business intelligence data, including financial reports, operational metrics, customer data, or proprietary analytics. Since Metabase is used to visualize and query connected databases, the attacker may effectively gain a read-only window into underlying data sources, potentially exposing sensitive information protected by SSO and MFA.

CVSS Analysis: The vulnerability holds a CVSS score of 6.5, reflecting a Medium severity (though the CVSS vector is not provided, the score indicates moderate impact). The attack requires network access and low privileges (knowledge of a valid user email), with no user interaction beyond the reset flow. The confidentiality impact is High, as unauthorized data access is the primary consequence. Integrity and availability impacts are low or none.

Affected Systems: All Metabase instances running versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9 that have SSO configured. The vulnerability affects both Open Source and Enterprise editions (the "0.x" and "1.x" version lines respectively).

Blast Radius: The blast radius is limited to a single Metabase instance per exploitation, but the scale depends on deployment. In organizations where Metabase is a central BI hub connected to multiple data warehouses, the downstream data exposure could be substantial. EPSS score of 0.00500 (40.3% percentile) suggests low current exploitation likelihood, and the CVE is not on the CISA KEV list, indicating no observed in-the-wild exploitation as of the report date.

Detection Guidance

Sigma Rule

title: Metabase SSO User Password Reset - Authentication Bypass
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects password reset attempts targeting SSO-managed users in Metabase, potentially indicating authentication bypass attempts.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-39360
author: Valters IT Security
date: 2024/01/01
tags:
    - attack.t1078
    - cve.2022.39360
logsource:
    category: web_application
    product: metabase
    definition: 'Requires Metabase application logs or web server logs capturing application-specific events.'
detection:
    selection:
        event|contains:
            - 'password_reset'
            - 'forgot_password'
            - 'reset_password'
    filter_SSO_enabled:
        user_sso: 'true'  # Placeholder; adjust based on actual log fields
    condition: selection and filter_SSO_enabled
level: high

Note: The exact log structure depends on Metabase's internal logging; this rule should be adapted to the actual log sources available. Due to insufficient technical detail in the NVD description, this rule is based on the vulnerability class and may require tuning.

YARA Rule

rule Metabase_SSO_Bypass_CVE_2022_39360
{
    meta:
        author = "Valters IT Security"
        description = "Detects Metabase password reset requests for SSO users - CVE-2022-39360"
        date = "2024-01-01"
        cve = "CVE-2022-39360"
        score = 60
    strings:
        $s1 = "password_reset" ascii nocase
        $s2 = "forgot" ascii nocase
        $s3 = "reset" ascii nocase
        $s4 = "sso" ascii nocase
        $s5 = "ldap" ascii nocase
        $s6 = "saml" ascii nocase
    condition:
        (uint16(0) == 0x0A0D or uint16(0) == 0x0D0A) and
        all of them
}

Note: This YARA rule targets HTTP request bodies or server logs containing keywords related to password reset combined with SSO indicators. It is a detection heuristic rather than a byte-pattern for a specific exploit, given that no PoC or exact request structure is publicly documented for this CVE.

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"METABASE SSO User Password Reset Attempt - CVE-2022-39360"; flow:to_server,established; content:"POST"; http_method; content:"/auth/forgot_password"; http_uri; content:"email="; http_client_body; pcre:"/email=[^&]+(@|%40)/i"; classtype:attempted-admin; sid:202239360; rev:1; metadata:created_at 2024_01_01, updated_at 2024_01_01, cve CVE-2022-39360)

Note: The URL path /auth/forgot_password is inferred from common Metabase route patterns and is NOT explicitly confirmed by the NVD description. Analysts should validate the actual endpoint using their own instance or adjust the rule to match observed traffic. If the endpoint is incorrect, this rule will generate false positives or negatives.

Elastic Detection

sequence by source.ip with maxspan=5m
  [any where process.name == "metabase" and message like "*password_reset*"]
  [any where process.name == "metabase" and message like "*sso*" or message like "*ldap*" or message like "*saml*"]

Note: This EQL rule assumes Elastic Endpoint or auditbeat monitoring of Metabase application logs. Adjust field names based on your Elastic integration.

Splunk SPL Query

index=metabase sourcetype=metabase_web
"password_reset" OR "forgot_password" OR "reset_token"
| eval is_sso_user = if(match(user_auth, "(?i)sso|ldap|saml"), "true", "false")
| where is_sso_user == "true"
| stats count by user, src_ip, _time

Note: Field names are illustrative. Adjust to match your Metabase log sourcetype.

Wazuh OSSEC Rule

<group name="metabase,">
  <rule id="100393" level="10">
    <decoded_as>json</decoded_as>
    <field name="url">\.*forgot_password\.*|\.*reset_password\.*</field>
    <description>Metabase password reset attempt detected for potentially SSO-managed user</description>
    <mitre>
      <id>T1078</id>
    </mitre>
    <group>authentication_bypass,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 3/4 (LIKELY) — Two independent sources (CNA and OSV) confirm the existence of a fix.

1) Immediate Mitigations:

• If immediate patching is not possible, consider disabling the public password reset feature via a reverse proxy or WAF until the patch is applied (this may impact legitimate users but reduces risk).
• Restrict network access to the Metabase instance — limit exposure to internal networks only, or require VPN access for remote users.
• Review current user accounts for any SSO-managed users that may have local passwords set; if any exist, reset and disable local login for those accounts.

2) Patch/Upgrade Steps:

• Upgrade Immediately: Upgrade to the following patched versions (or later):
  • Open Source: 0.44.5, 0.43.7, 0.42.6, 0.41.9
  • Enterprise: 1.44.5, 1.43.7, 1.42.6, 1.41.9
• Refer to the official Metabase release notes and upgrade documentation for the specific version compatible with your deployment.
• After patching, verify that SSO users can no longer initiate password resets (attempt a reset and confirm it is blocked).

3) Long-Term Hardening:

• Ensure Metabase is not directly exposed to the internet unless strictly required; use a reverse proxy with strong authentication if exposure is necessary.
• Enforce SSO as the sole authentication mechanism at the application level and disable local authentication entirely where possible.
• Monitor Metabase authentication logs for anomalies, particularly password reset events targeting SSO-managed accounts.
• Implement conditional access policies at the IdP level to restrict login origin and enforce MFA.
• Keep Metabase and all dependencies up to date; subscribe to Metabase security advisories for future vulnerability notifications.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-39360
2. Metabase Security Advisories: https://github.com/metabase/metabase/security/advisories
3. OSV Database Entry: https://osv.dev/vulnerability CVE-2022-39360 (via OSV Package metabase hashes: c529fe2f7a6be48354fedd8f36c940b787bafa2d, de1264e1b2c3516181a3e115803abe32b74a1b7b, ee686fcfe5a006e228090a150365d4495bbb549c)
4. Metabase Official Website and Version History: https://www.metabase.com/
5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2022-39360 is NOT listed as of this report)

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No exploitation in the wild has been publicly documented for CVE-2022-39360. EPSS score of 0.00500 (40.3% percentile) and absence from CISA KEV indicate low exploitation activity. No known threat actor campaigns reference this CVE at the time of writing. These references include vendor audit trails, OSV tracking with the affected package hashes provided, and NVD source data.