CVE-2022-39362

Executive Summary

CVE-2022-39362 is a high-severity vulnerability in Metabase, an open-source business intelligence and data visualization platform, that permits arbitrary SQL execution through unsaved (ad-hoc) native queries. Prior to patched versions, Metabase automatically executed unsaved SQL queries without requiring explicit user confirmation, enabling an attacker with access to the application to run arbitrary SQL statements against the underlying data warehouse. The flaw carries a CVSS score of 8.8, indicating high impact to confidentiality, integrity, and availability, and affects both the open-source (0.x) and enterprise (1.x) release lines. The vendor has addressed this issue by requiring users to manually trigger execution of ad-hoc native queries in the query editor.

Technical Analysis

The vulnerability resides in Metabase's native query execution engine. Prior to the patched versions, the platform automatically executed unsaved SQL queries — referred to in the CNA title as "queryhash" — without requiring a separate user-initiated action such as clicking a "Run" button. This behavior is described in the NVD record: "unsaved SQL queries are auto-executed, which could pose a possible attack vector."

The attack surface is the Metabase web application's native query editor, which allows authenticated users to write raw SQL against connected data sources. Under the vulnerable design, when a query was constructed or modified in the editor but not explicitly saved, the application would still execute it automatically. This creates a dangerous execution path because the query can be manipulated or substituted without the user's awareness, and the system does not gate execution behind an explicit confirmation step.

From a code-level perspective, the CNA title references "queryhash," which strongly implies that queries are serialized and passed (likely via a URL hash parameter or internal state object) to the backend for execution. Because the hash containing the SQL payload is processed and executed automatically, a crafted hash can be delivered to a victim user's browser or directly to the Metabase backend, resulting in arbitrary SQL execution. The NVD description explicitly notes that the fix involves no longer auto-executing ad-hoc native queries — instead, "the native editor shows the query and gives the user the option to manually run the query if they want." This confirms that the root cause is the automatic execution of user-supplied SQL payloads without an authorization or confirmation boundary between query construction and query execution.

The underlying weakness can be classified as an injection flaw (CWE-89, SQL Injection) in the broad sense, although the precise mechanism is an unsafe default behavior of automatically executing constructed queries. The severity is elevated (CVSS 8.8) because the vulnerability can be triggered by a low-privileged authenticated user (PR:L) and does not require user interaction (UI:N), with high impact to all three security pillars (C:H/I:H/A:H).

Exploitation Scenarios

No public proof-of-concept exploit is currently available, and there is no evidence of exploitation in the wild (CISA KEV: NO, EPSS percentile: 54.0%). The attack chain below is inferred from the vulnerability class and the NVD description.

1. Reconnaissance / Target Identification: An attacker first identifies an exposed Metabase instance. This can be accomplished via internet-wide scanning using search engine dorks such as title:"Metabase" or by querying Shodan for the product. The attacker then authenticates to the application (either with valid low-privileged credentials or by compromising a user account). The vulnerability requires an authenticated session, so the attacker must obtain at least a standard user account.

2. Triggering the Flaw: Once authenticated, the attacker navigates to the native query editor. The attacker crafts a malicious SQL payload and constructs an unsaved query — represented internally as a "queryhash." Because the vulnerable versions auto-execute unsaved SQL queries, merely constructing the query (or receiving a crafted queryhash via a crafted link) triggers backend execution immediately. The attack does not require the victim to click "Run" or any equivalent confirmation button, as this behavior does not exist in the vulnerable implementation.

3. Payload / Execution Method: The payload is arbitrary SQL. The attacker can inject statements such as SELECT to exfiltrate data, INSERT/UPDATE to modify records, DROP to destroy tables, or database-specific functions to read local files or invoke stored procedures. The exact SQL dialect and available functions depend on the underlying database (PostgreSQL, MySQL, etc.) connected to Metabase.

4. Post-Exploitation Impact: Successful arbitrary SQL execution grants the attacker the same privileges as the database user configured for the Metabase connection, which is often a highly privileged account. The attacker can exfiltrate data from all connected databases, modify or corrupt data, create backdoor accounts in the application database, or, in some configurations, achieve operating-system-level access via xp_cmdshell (MSSQL) or COPY ... FROM PROGRAM (PostgreSQL). In a multi-tenant Metabase deployment, this single vulnerability can compromise all dashboards, data sources, and downstream consumers of the BI platform.

Impact Assessment

• CVSS Score: 8.8 (High) with vector components indicating Network access (AV:N), Low attack complexity (AC:L), Low privileges required (PR:L), No user interaction (UI:N), Unchanged scope (S:U), and High impact to Confidentiality (C:H), Integrity (I:H), and Availability (A:H).

• Business Impact: Metabase is a central BI platform used by data analysts, engineers, and executives. A successful exploit leads to a complete compromise of the connected data warehouse, including customer PII, financial records, intellectual property, and internal metrics. The Integrity and Availability subscores are also High, meaning the attacker can modify or destroy data, causing regulatory penalties (GDPR, HIPAA, PCI-DSS), loss of customer trust, and significant operational downtime.

• Affected Systems: All Metabase instances running versions prior to 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, and 1.41.9. This spans both open-source and enterprise distributions (0.x and 1.x lines respectively).

• Blast Radius: The Default-allow behavior of auto-executing queries means that any authenticated user — regardless of their role or data permissions — can potentially leverage this to escalate to full database access. In deployments where Metabase is exposed to the internet, the attack surface is expanded further.

• EPSS Consideration: The EPSS score of 0.00826 (54th percentile) indicates a below-average likelihood of exploitation in the wild at the time of assessment, but this is a lagging indicator and should not reduce the priority of patching.

Detection Guidance

Sigma Rule

title: Metabase Unsaved Query Auto-Execution Attempt
id: 3f8a1c2e-9b41-4f7e-8a2d-5c3b6e7f1a0d
status: experimental
description: Detects attempts to exploit CVE-2022-39362 by triggering automatic execution of unsaved native SQL queries in Metabase versions prior to 0.44.5/1.44.5.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2022-39362
author: valtersit.com Threat Intel Team
date: 2023/05/15
logsource:
    category: webserver
    product: nginx
    service: http
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains:
            - '/api/dataset'
            - '/api/dataset/native'
    keywords:
        - 'queryhash'
        - 'native'
        - 'query'
        - 'execute'
    condition: selection and keywords
    timeframe: 5m
level: high
falsepositives:
    - Legitimate use of the native query editor by analysts
tags:
    - attack.t1213
    - cve.2022.39362

YARA Rule

rule Metabase_CVE_2022_39362_QueryHash_Exploit {
    meta:
        author = "valtersit.com Threat Intel Team"
        description = "Detects crafted queryhash payloads targeting automatic SQL execution in Metabase"
        date = "2023-05-15"
        cve = "CVE-2022-39362"
        severity = "high"
    strings:
        $s1 = "queryhash" ascii wide nocase
        $s2 = "unsaved" ascii wide nocase
        $s3 = "native" ascii wide nocase
        $s4 = "dataset" ascii wide nocase
        $s5 = "auto-execut" ascii wide nocase
        $s6 = "execution" ascii wide nocase
        $sql1 = /SELECT\s+(?![\w]+\(\))[^\;]{1,200}/ ascii nocase
        $sql2 = /INSERT\s+INTO/ ascii nocase
        $sql3 = /DROP\s+TABLE/ ascii nocase
        $sql4 = /UPDATE\s+[\w\.\[\]"]+\s+SET/ ascii nocase
    condition:
        uint16(0) == 0x5B7B or uint16(0) == 0x0A0D or filesize < 5KB and
        (1 of ($s*) and 1 of ($sql*))
}

Suricata IDS Rule

alert http any any -> any any (
    msg:"CVE-2022-39362 Metabase Unsaved SQL Query Auto-Execution Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/dataset"; http_uri;
    content:"queryhash"; http_client_body;
    nocase;
    content:"native"; http_client_body;
    nocase;
    content:"query"; http_client_body;
    nocase;
    pcre:"/(SELECT|INSERT|UPDATE|DELETE|DROP)\s+/i";
    sid:202239362;
    rev:1;
    metadata:attack_target_web, created_at_2023_05_15, cve_2022_39362, deployment_any, signature_severity_critical, tag_sql_injection;
    reference:url, https://nvd.nist.gov/vuln/detail/CVE-2022-39362;
)

Elastic Detection

sequence by source.ip with maxspan=2m
  [ network where event.category == "web" and http.request.method == "POST"
      and http.request.body.content contains "queryhash"
      and http.request.body.content contains "native" ]
  [ file where event.category == "file" and process.name == "java"
      and file.extension in ("log", "tmp") ]

Splunk SPL Query

index=web sourcetype=access_combined
| where method="POST"
| regex _raw="(/api/dataset)"
| regex _raw="queryhash"
| regex _raw="(native)"
| regex _raw="(SELECT|INSERT|UPDATE|DELETE|DROP|ALTER)\s+"
| table _time, src_ip, uri_path, http_user_agent, status
| stats count by src_ip, uri_path, http_user_agent
| sort - count

Wazuh OSSEC Rule

<group name="metabase,">
  <rule id="100293" level="12">
    <decoded>attack.metabase_sql_auto_execution</decoded>
    <match>queryhash|native</match>
    <regex>POST /api/dataset</regex>
    <description>CVE-2022-39362: Metabase arbitrary SQL execution attempt via unsaved queryhash</description>
    <mitre><id>T1213</id></mitre>
    <group>web_application_attack,sql_injection,</group>
    <status>experimental</status>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED — no patch evidence from any tracked source was found in the provided data. However, the NVD description confirms official patched versions exist.

Immediate Mitigations:

1. Upgrade Metabase to one of the patched versions immediately: 0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, or 1.41.9 (choose the version matching your release line). This upgrade disables auto-execution of unsaved ad-hoc native queries.
2. Restrict network access to the Metabase web interface to trusted IP ranges or place it behind a VPN. Do not expose it directly to the internet unless strictly required.
3. Enforce robust authentication with multi-factor authentication (MFA) for all Metabase users, and review user accounts for stale or unnecessary privileged access.
4. Implement a Web Application Firewall (WAF) rule to block requests to /api/dataset containing SQL keywords in the body, as a temporary compensating control while patches are being rolled out.

Patch/Upgrade Steps:

1. Back up the Metabase application database and any configuration files.
2. Download the patched version (0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, or 1.41.9) from the official vendor source.
3. Follow the vendor's standard upgrade procedure (e.g., replacing the JAR file or updating the Docker image).
4. After upgrade, verify that unsaved queries are no longer auto-executed by creating a test ad-hoc native query and confirming the editor now requires a manual "Run" action.
5. Review database connection accounts used by Metabase — reduce privileges to least-privilege (e.g., remove DROP, CREATE, and administrative-level permissions) to limit the blast radius of future injection flaws.

Long-Term Hardening:

1. Consider restricting Metabase database connections to read-only accounts where analysis does not require data modification.
2. Implement database-level auditing to monitor for unusual SQL activity from the Metabase service account.
3. Establish a vulnerability management cadence to ensure Metabase and its dependencies are patched within 30 days of vendor release.
4. Monitor Metabase access logs for anomalous patterns, especially POST requests to the native query endpoint from unexpected source IPs or during unusual hours.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2022-39362 — Official NVD record providing the description and CVSS scoring (CVSS: 8.8).
2. Metabase Vendor Security Release: The patched version list (0.44.5, 1.44.5, 0.43.7, 1.43.7, 0.42.6, 1.42.6, 0.41.9, 1.41.9) is derived from the NVD description; the official vendor advisory is available via Metabase's release notes/history at https://www.metabase.com/releases/ .
3. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — CVE-2022-39362 is not listed (CISA KEV: NO), indicating no known in-the-wild exploitation at the time of assessment.
4. FIRST EPSS: https://www.first.org/epss/ — EPSS score for CVE-2022-39362 is 0.00826 (54th percentile of scores), indicating a low-to-moderate likelihood of exploitation in the wild.

Known Threat Actor Campaigns: No threat actor campaigns have been publicly attributed to CVE-2022-39362 at the time of writing. No exploit code or public proof-of-concept is available (POC_STATUS: None, Exploit Code: NO, Nuclei Template: NO). Organizations should nonetheless prioritize patching given the criticality of the affected software (BI platform with database connectivity) and the ease of exploitation by any authenticated user.