CVE-2022-39361

Executive Summary

CVE-2022-39361 is a remote code execution (RCE) vulnerability in Metabase, a popular open-source data visualization and business intelligence platform. The flaw resides in the H2 sample database engine, where authenticated users with the ability to write SQL native queries against H2 databases can execute arbitrary code on the underlying server. The vulnerability affects multiple Metabase branches prior to versions 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Successful exploitation results in full compromise of the Metabase application server, with CVSS score 8.8 indicating high severity.

The attack vector requires low-privilege authenticated access (user-level privileges with SQL query permissions) and no user interaction, making it a significant risk for enterprise deployments where Metabase is exposed to internal or external networks. Although CISA KEV does not currently list this vulnerability and no public exploit code has been confirmed, the technical class of vulnerability (H2 RCE via DDL statements) is well-documented in security research and carries elevated exploitation risk.

Technical Analysis

Metabase is data visualization software that allows users to create dashboards, run ad-hoc queries, and explore datasets through a web interface. A core feature of Metabase is the ability to write native SQL queries directly against configured database connections. Among the supported database types, Metabase includes H2 as a bundled sample database used for demonstration and evaluation purposes.

The vulnerability arises from the interaction between Metabase's native query interface and the H2 database engine. H2 is a Java-based relational database management system that, by default, enables certain advanced features including the ability to execute Java code through user-defined functions, aliases, and other database objects. Specifically, H2 supports DDL (Data Definition Language) statements such as CREATE ALIAS, which can associate a custom Java function with a new database function name. When invoked, these aliases execute arbitrary Java code within the context of the Metabase application server's Java Virtual Machine (JVM).

Prior to the patched versions, Metabase did not restrict the types of SQL statements that users could execute against H2 databases. This meant that any user with write access to the H2 sample database — i.e., users who could submit native SQL queries — could issue DDL statements. A malicious user could craft a query sequence that:

1. Creates a new Java function alias via a DDL statement (e.g., CREATE ALIAS).
2. Associates that alias with a Java class and method capable of executing system commands (e.g., java.lang.Runtime.exec).
3. Invokes the newly created alias through a standard SQL query, triggering arbitrary command execution on the host server.

The patch addresses this by preventing DDL statements in H2 native queries entirely. This restriction eliminates the attack primitive by not allowing users to create the malicious database objects required for code execution. The fix is applied across all affected version branches (0.x and 1.x series), indicating a systematic issue rather than a one-off flaw in a specific release line.

The attack surface is the Metabase web application's SQL query editor, accessible via the UI or the REST API. The pre-requisite is that the target Metabase instance has the H2 sample database enabled (which it is by default for evaluation purposes) and that the attacker holds an account with permission to run native queries. Administrative privileges are not required, making this a privilege-escalation-adjacent vulnerability that can turn a low-privilege data analyst account into full server compromise.

Exploitation Scenarios

The exploitation of CVE-2022-39361 follows a structured attack chain based on the vulnerability class of unrestricted DDL execution in H2 databases.

Step 1: Reconnaissance and Target Identification An attacker begins by identifying Metabase instances exposed on the network. This can be done via internet-wide scanning using search engines like Shodan with queries targeting the default Metabase login page or application banner, or through internal network scanning. The attacker then attempts to access the Metabase login page and tests for default credentials or performs credential stuffing/brute-force attacks. For external attacks, the attacker would typically require valid credentials; for internal threats, any data analyst with SQL query access suffices.

Step 2: Triggering the Vulnerability Class Once authenticated with a user account that has permissions to run native SQL queries, the attacker opens the SQL query editor within the Metabase web interface. The target database is the H2 sample database, which is available by default in a fresh Metabase installation. The attacker needs to select the H2 database as the query target. The vulnerability is triggered by crafting a SQL statement that falls under DDL — a class of statements that should not be permitted in a read-oriented analytics tool but was allowed in vulnerable versions.

Step 3: Payload Execution at the Vulnerability-Class Level The attacker submits a DDL statement to the H2 engine. In the H2 database, DDL commands can be used to create database constructs that invoke Java code. The attacker leverages H2's alias creation capability to register a Java class that executes operating system commands. For example, the attacker might create an alias that wraps a Java runtime method allowing command execution, then issue a standard SQL SELECT statement invoking that alias with a command payload of their choice. The H2 engine, running inside the Metabase server's JVM, executes the Java code, resulting in arbitrary command execution on the host operating system with the privileges of the Metabase service account. The exact class names and method invocations are not publicly documented for this specific CVE, but the H2 RCE technique is well-established in the security community.

Step 4: Post-Exploitation Impact Successful command execution grants the attacker a foothold on the server. The attacker can then proceed with standard post-exploitation activities: reading sensitive files (including Metabase configuration files that may contain database credentials), extracting environment variables, potentially escalating privileges via local kernel exploits, moving laterally to other databases and systems accessible from the compromised host, and either exfiltrating the data visualization organization's sensitive datasets or deploying ransomware and persistence mechanisms. Because Metabase often sits with network access to multiple backend analytical databases, the blast radius can extend far beyond the single compromised host. No public PoC is available for this specific CVE; the attack chain is inferred from the vulnerability class and prior research on H2 database exploitation techniques.

Impact Assessment

The business impact of CVE-2022-39361 is severe. The vulnerability allows an authenticated low-privilege user to execute arbitrary code on the Metabase server, achieving full host compromise. The CVSS score of 8.8 (High) reflects the high confidentiality, integrity, and availability impact combined with a low-complexity attack over the network requiring only low privileges and no user interaction.

From a business perspective, the risks are multifaceted:

• Data Breach: Arbitrary code execution gives attackers access to all data stored in connected databases. If Metabase has connections to production or sensitive analytical databases, the attacker can read, export, or manipulate this data. This could include personally identifiable information (PII), financial records, or intellectual property.
• Lateral Movement: Compromised Metabase servers often have service accounts with broad connectivity to backend infrastructure. An attacker can use the foothold to pivot into database clusters, cloud environments (via metadata service credentials), or other application servers.
• Operational Disruption: The attacker could deploy ransomware, destroy data, or disrupt the Metabase service itself, leading to business intelligence outages that impact decision-making across the organization.
• Compliance Violations: A breach of this nature could trigger mandatory disclosure obligations under regulations such as GDPR, HIPAA, or PCI DSS, leading to fines, legal liability, and reputational damage.

The affected systems are all Metabase instances running versions prior to those listed in the patched set. Given Metabase's popularity among data teams and startups, the potential number of exposed instances is significant. The fact that the vulnerability exists across eight version lines (0.41.x through 0.44.x, and 1.41.x through 1.44.x) suggests a systemic gap in query validation that persisted for several months of releases.

Detection Guidance

Sigma Rule

title: Metabase H2 RCE via DDL Statement
id: b2e4a5c2-4f8e-4b9a-9f4c-1d7e8f0a3b5c
status: experimental
description: Detects DDL statements in native SQL queries against H2 databases in Metabase logs, indicating potential exploitation of CVE-2022-39361.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-39361
author: Valters IT Security
date: 2023/11/15
logsource:
    product: metabase
    service: app
detection:
    selection:
        database:
            - 'h2'
            - 'H2'
        query:
            - '*CREATE*ALIAS*'
            - '*CREATE*TRIGGER*'
            - '*RUNSCRIPT*'
            - '*CREATE*FUNCTION*'
    condition: selection
level: high
falsepositives:
    - Legitimate database administrator activity creating H2 functions for ETL processes (rare)
tags:
    - attack.t1210
    - cve.2022-39361

YARA Rule

rule Metabase_H2_RCE_DDL_Statements
{
    meta:
        author = "Valters IT Security"
        description = "Detects DDL statements targeting H2 databases in Metabase SQL query logs"
        reference = "CVE-2022-39361"
        date = "2023-11-15"
        score = 85

    strings:
        $s1 = "CREATE ALIAS" ascii nocase
        $s2 = "CREATE TRIGGER" ascii nocase
        $s3 = "RUNSCRIPT FROM" ascii nocase
        $s4 = "org.h2" ascii nocase
        $s5 = "java.lang.Runtime" ascii nocase
        $s6 = "javax.script" ascii nocase
        $s7 = "databaseName=h2" ascii nocase
        $s8 = "h2" ascii nocase

    condition:
        (any of ($s1, $s2, $s3)) and (any of ($s4, $s5, $s6))
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Metabase H2 DDL RCE Attempt (CVE-2022-39361)"; flow:established,to_server; content:"CREATE ALIAS"; http_client_body; nocase; content:"java"; http_client_body; distance:0; content:"Runtime"; http_client_body; distance:0; metadata:created_at 2023_11_15, updated_at 2023_11_15; reference:url,https://nvd.nist.gov/vuln/detail/CVE-2022-39361; reference:cve,2022-39361; classtype:attempted-user; sid:2023936101; rev:1;)

Elastic Detection

// EQL query for Elastic Security - detect DDL statements in Metabase SQL query logs
sequence by host.name, user.name with maxspan=5m
  [ process where event.action == "write" and
    process.name == "java" and
    process.args : "*metabase*" ]
  [ file where event.action == "write" and
    file.path : "*metabase*log*" and
    (file.text : "*CREATE ALIAS*" or
     file.text : "*CREATE TRIGGER*" or
     file.text : "*RUNSCRIPT*") ]

Splunk SPL Query

index=metabase sourcetype=metabase_logs
| where match(query, "(?i)(CREATE\s+ALIAS|CREATE\s+TRIGGER|RUNSCRIPT)")
| search database=h2 OR database=H2
| table _time, user, query, database, src_ip
| eval exploit_attempt=if(match(query, "(?i)(CREATE\s+ALIAS)"), "HIGH", "MEDIUM")
| sort - _time

Wazuh OSSEC Rule

<rule id="100393" level="15">
    <decoded_as>json</decoded_as>
    <field name="type">metabase</field>
    <regex>CREATE\s+ALIAS</regex>
    <description>Metabase H2 DDL statement detected - potential CVE-2022-39361 exploitation</description>
    <group>metabase_vulnerability,</group>
    <mitre>
        <id>T1210</id>
    </mitre>
</rule>

<rule id="100394" level="12">
    <decoded_as>json</decoded_as>
    <field name="type">metabase</field>
    <regex>RUNSCRIPT</regex>
    <description>Metabase H2 RUNSCRIPT detected - potential CVE-2022-39361 exploitation</description>
    <group>metabase_vulnerability,</group>
    <mitre>
        <id>T1210</id>
    </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source. Despite the vendor advisory referencing patched versions (0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9), no patch artifacts have been confirmed across the tracked sources. This may indicate delayed availability in some distribution channels or incomplete tracking. Verify the availability of the patched versions through your official Metabase distribution channel (standard distribution, Docker Hub, or private deployments).

1. Immediate Mitigations

• Disable the H2 Sample Database: If not already done, remove or disable the bundled H2 sample database from all Metabase instances. This eliminates the attack surface entirely. In Metabase, this can be achieved by removing the Sample Database in the Admin settings under Data > Databases.
• Restrict SQL Query Permissions: For any H2 database that must remain active, restrict native SQL query permissions to only trusted administrators. Remove "Write" permissions from all standard users and groups. Revoke the ability to write SQL queries on H2 databases from non-admin accounts.
• Network Access Control: Limit access to the Metabase web interface to trusted IP addresses or VPN-only access. Place Metabase behind a reverse proxy with strict access control policies, and do not expose it directly to the internet.
• Monitor and Alert: Deploy the detection guidance provided above to identify and alert on any DDL statements being executed against H2 databases. Investigate any alerts immediately.

2. Patch/Upgrade Steps

• Upgrade Metabase: Upgrade to the patched versions as soon as they are confirmed available for your distribution channel. The fixed versions are 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. Select the version that corresponds to your current branch (e.g., if on 0.43.x, upgrade to 0.43.7 or higher 0.44.x).
• Verify Patch Deployment: After upgrading, verify that the new version is running and that DDL statements in H2 native queries are no longer permitted. Test by attempting to execute a benign DDL statement (e.g., CREATE ALIAS for a dummy function) and confirm it is rejected.
• For Docker Deployments: Pull the patched Docker images (e.g., metabase/metabase:v0.44.5) and redeploy with rolling restarts to minimize downtime.

3. Long-term Hardening

• Apply Principle of Least Privilege: Regularly audit user roles and permissions within Metabase. Ensure that only truly necessary users have native SQL query access, and that no standard users require DDL capability.
• Remove Default Databases: On production instances, remove all sample and demonstration databases immediately after initial deployment.
• Periodic Security Reviews: Subscribe to Metabase security advisories and incorporate CVE monitoring into your vulnerability management process. Metabase publishes security updates; ensure these are applied within your SLA window.
• Network Segmentation: Separate the Metabase server from the rest of the corporate network. Use firewalls to limit egress and ingress traffic and to ensure that a compromised Metabase host does not have unfettered access to the broader network.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-39361
2. Metabase Security Advisory: https://www.metabase.com/security/ (Vendor security announcements)
3. H2 Database Security Research: https://mthbernardes.github.io/rce/2018/03/14/abusing-h2-database-alias.html — Research documenting H2 alias-based RCE techniques, relevant to this vulnerability class.
4. MITRE ATT&CK Technique T1210: https://attack.mitre.org/techniques/T1210/ — Exploitation of Remote Services.
5. CISA KEV Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2022-39361 is not currently listed in CISA's Known Exploited Vulnerabilities catalog.

Threat Actor Campaigns / Exploit-in-the-Wild Evidence: No confirmed in-the-wild exploitation campaigns were identified for CVE-2022-39361 at the time of this report. The EPSS score of 0.01007 (59.8th percentile of exploited CVEs) suggests moderate exploitation probability. No public proof-of-concept code or Nuclei templates were found. However, given the well-documented H2 RCE techniques in public research and the ease of authentication with common or leaked credentials, organizations should treat this vulnerability with high priority once patched versions are confirmed available.