CVE-2024-55951

Executive Summary

CVE-2024-55951 is a data exposure vulnerability in the Metabase open-source data analytics platform, affecting versions 1.52.0 through 1.52.2.4. The flaw resides in the sandboxing feature, where newly created sandboxing configurations inadvertently allow sandboxed users to view field filter values belonging to other sandboxed users. This breaks the intended isolation between sandboxed users, potentially exposing sensitive data that should be restricted. The vulnerability has been patched in version 1.52.2.5, and there are no known workarounds. No public proof-of-concept (PoC) or exploit code has been identified at this time.

Supply Chain & Package Security

Metabase is distributed as a Java JAR file and via Docker images. The vulnerability is introduced in the application code itself, not in a third-party dependency. Users should verify the integrity of their Metabase installation by checking the official release checksums and ensuring they are running a trusted version from the official Metabase repository.

CVSS Breakdown & Threat Level

The CVSS score for this CVE is listed as 0.0, which is likely a placeholder or unassigned value. Based on the vulnerability description, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker needs a valid sandboxed user account.
• User Interaction (UI): None (N) – No user interaction is required.
• Scope (S): Changed (C) – The vulnerable component (sandbox) allows access to resources (other sandboxed users' data) beyond its intended scope.
• Confidentiality (C): High (H) – Sensitive field filter values from other sandboxed users are exposed.
• Integrity (I): None (N) – No data modification is possible.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Estimated Base Score: 7.7 (High)

Threat Level: High. While the attack requires a valid sandboxed user account, the potential for data leakage across sandbox boundaries poses a significant risk to multi-tenant environments.

Deep Dive & Mechanics

The vulnerability is rooted in how Metabase manages sandboxing configurations. Sandboxing is a feature that restricts data access for specific users or groups, typically by applying row-level or column-level filters. In affected versions (1.52.0 to 1.52.2.4), when a new sandboxing configuration is created, the system fails to properly isolate the field filter values (e.g., dropdown options, search suggestions) for that sandbox. As a result, a sandboxed user can see filter values that belong to other sandboxed users, potentially exposing data that should be hidden.

The root cause is likely a caching or session management issue where filter values are not scoped to the individual sandbox context. Instead, they are shared across all sandboxed users, leading to cross-sandbox data leakage.

Vulnerable vs. Patched Code

No specific code diff is publicly available. However, the patch in version 1.52.2.5 addresses the issue by ensuring that field filter values are properly scoped to the sandbox configuration of the requesting user. The fix likely involves changes to the backend logic that generates and caches filter values, ensuring that each sandboxed user only sees values relevant to their own sandbox.

Vulnerable Code (Conceptual):

// In a service that retrieves field filter values
public List<String> getFieldFilterValues(Field field, User user) {
    // Incorrectly returns all values without sandbox scoping
    return fieldRepository.findAllDistinctValues(field);
}

Patched Code (Conceptual):

// In a service that retrieves field filter values
public List<String> getFieldFilterValues(Field field, User user) {
    // Correctly scopes values to the user's sandbox
    Sandbox sandbox = sandboxRepository.findByUser(user);
    return fieldRepository.findDistinctValuesForSandbox(field, sandbox);
}

Exploitation & Lab Setup

Red Team

1. Prerequisites: Obtain a valid sandboxed user account on a vulnerable Metabase instance (version 1.52.0 to 1.52.2.4).
2. Exploitation Steps:
   • Log in as the sandboxed user.
   • Navigate to a question or dashboard that uses a field filter (e.g., a dropdown or search box).
   • Interact with the filter to view available values. Due to the vulnerability, you may see values that belong to other sandboxed users.
   • Use browser developer tools or intercepting proxy (e.g., Burp Suite) to inspect API responses for filter values.
3. Expected Outcome: The attacker can enumerate field filter values from other sandboxed users, potentially gaining access to sensitive data (e.g., customer names, account numbers) that should be restricted.

Blue Team

1. Detection: Monitor for unusual patterns in API requests to endpoints related to field filters (e.g., /api/field/*/values). Look for requests from sandboxed users that return an unexpectedly large number of distinct values.
2. Hunting: Review logs for sandboxed users accessing filter values that are outside their expected scope. Correlate with sandbox configuration changes.
3. Mitigation: Immediately upgrade to Metabase version 1.52.2.5 or later. If upgrade is not possible, consider disabling the sandboxing feature temporarily or restricting access to sensitive fields.

Indicators of Compromise (IOCs)

• Network: Unusual API responses from /api/field/*/values endpoints containing data from multiple sandbox contexts.
• Logs: Repeated access to field filter endpoints by sandboxed users, especially if the number of returned values is inconsistent with their sandbox scope.
• System: Metabase version string indicating 1.52.0, 1.52.1, or 1.52.2.x (where x < 5).

Detection Engineering

YARA Rule

rule CVE_2024_55951_Metabase_Sandbox_Leak {
    meta:
        description = "Detects Metabase versions vulnerable to CVE-2024-55951"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-55951"
    strings:
        $version_string = "Metabase v1.52." ascii wide
        $patch_version = "Metabase v1.52.2.5" ascii wide
    condition:
        $version_string and not $patch_version
}

Sigma Rule

title: Metabase Sandbox Data Leak Detection
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects potential exploitation of CVE-2024-55951 by monitoring for unusual field filter value requests from sandboxed users.
author: Valters IT
date: 2025/04/10
logsource:
    category: application
    product: metabase
detection:
    selection:
        http.url|contains: "/api/field/"
        http.method: "GET"
        user.role: "sandboxed"
    condition: selection
falsepositives:
    - Legitimate sandboxed users accessing their own filter values.
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-55951 Metabase Sandbox Data Leak";
    flow:to_server,established;
    content:"/api/field/"; http_uri;
    content:"values"; http_uri;
    classtype:attempted-recon;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Action: Upgrade to Metabase version 1.52.2.5 or later. This is the only known fix.

Workarounds: None available. Disabling the sandboxing feature may reduce risk but is not a complete solution.

Long-term Measures:

• Implement strict access controls and monitoring for sandboxed users.
• Regularly review and audit sandbox configurations.
• Keep Metabase updated to the latest stable version.
• Consider using network segmentation to isolate sensitive data.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.