CVE-2025-50465

Executive Summary

CVE-2025-50465 is a SQL Injection vulnerability in OpenMetadata versions up to and including 1.4.4. The flaw resides in the listCount function within the TestDefinitionDAO interface. An attacker can manipulate the testPlatform parameter to inject arbitrary SQL commands, leading to unauthorized extraction of sensitive information from the database. With a CVSS score of 7.1, this vulnerability poses a significant risk to data confidentiality. No public proof-of-concept (PoC) or patch is currently available, making it a critical zero-day threat for organizations using OpenMetadata.

Supply Chain & Package Security

OpenMetadata is a Python-based metadata management platform. The vulnerability affects the core application, not a specific package manager. However, organizations should verify the integrity of their OpenMetadata installations and monitor for any malicious packages that may exploit this flaw.

CVSS Breakdown & Threat Level

• CVSS Score: 7.1 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: None
• Availability Impact: Low

Threat Level: High. The vulnerability is remotely exploitable without authentication, allowing attackers to extract sensitive database contents.

Deep Dive & Mechanics

The vulnerability exists in the listCount function of the TestDefinitionDAO interface. This function is designed to count test definitions based on certain criteria. The testPlatform parameter is used to filter results but is not properly sanitized before being incorporated into a SQL query.

Root Cause: The application constructs SQL queries by concatenating user-supplied input (testPlatform) directly into the query string without parameterization or escaping. This allows an attacker to inject arbitrary SQL commands.

Attack Vector: An attacker sends a crafted HTTP request to the vulnerable endpoint, manipulating the testPlatform parameter. For example:

GET /api/v1/testDefinitions/listCount?testPlatform=value' OR '1'='1

This injection can be used to extract data from other tables, bypass authentication, or perform other malicious actions.

Impact: Successful exploitation can lead to the disclosure of sensitive data stored in the database, such as user credentials, metadata, and configuration details.

Vulnerable vs. Patched Code

Vulnerable Code (OpenMetadata <=1.4.4):

# Example vulnerable code in TestDefinitionDAO
def listCount(self, testPlatform):
    query = "SELECT COUNT(*) FROM test_definitions WHERE test_platform = '" + testPlatform + "'"
    return self.execute_query(query)

Patched Code (Hypothetical):

# Patched code using parameterized queries
def listCount(self, testPlatform):
    query = "SELECT COUNT(*) FROM test_definitions WHERE test_platform = %s"
    return self.execute_query(query, (testPlatform,))

The patched version uses parameterized queries, which prevent SQL injection by separating SQL logic from user input.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable OpenMetadata instance (version <=1.4.4)
• Network access to the API endpoint

Exploitation Steps:

1. Identify the vulnerable endpoint: /api/v1/testDefinitions/listCount
2. Craft a malicious request with SQL injection in the testPlatform parameter:

   GET /api/v1/testDefinitions/listCount?testPlatform=value' UNION SELECT username,password FROM users--
   

3. Send the request using a tool like curl:

   curl "http://target:8585/api/v1/testDefinitions/listCount?testPlatform=value' UNION SELECT username,password FROM users--"
   

4. Analyze the response for extracted data.

Note: No public exploit code is available. The above is a conceptual example.

Blue Team (Detection & Defense)

Detection:

• Monitor for unusual SQL error messages in application logs.
• Look for requests containing SQL keywords (e.g., UNION, SELECT, OR) in the testPlatform parameter.
• Use Web Application Firewall (WAF) rules to block SQL injection patterns.

Defense:

• Immediately upgrade to a patched version once available.
• Implement input validation and parameterized queries.
• Restrict database permissions to limit the impact of successful injection.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /api/v1/testDefinitions/listCount with suspicious testPlatform values containing SQL keywords.
  • Unusual database error messages in HTTP responses (e.g., "SQL syntax error").

• Log IOCs:

  • Application logs showing SQL injection attempts (e.g., testPlatform=value' OR '1'='1).
  • Database logs with unexpected queries or errors.

• File IOCs:

  • Modified or new files in the OpenMetadata installation directory (if exploitation leads to file upload).

Detection Engineering

YARA Rule

rule CVE_2025_50465_SQL_Injection {
    meta:
        description = "Detects SQL injection attempts targeting OpenMetadata CVE-2025-50465"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50465"
    strings:
        $sqli1 = "testPlatform="
        $sqli2 = "UNION"
        $sqli3 = "SELECT"
        $sqli4 = "OR"
        $sqli5 = "1=1"
    condition:
        any of ($sqli*) and #sqli1 > 0
}

Sigma Rule

title: OpenMetadata SQL Injection Attempt (CVE-2025-50465)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts against OpenMetadata listCount endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains: 
            - "testPlatform="
            - "UNION"
            - "SELECT"
            - "OR"
            - "1=1"
    condition: selection
falsepositives:
    - Legitimate use of testPlatform parameter with similar strings
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-50465 OpenMetadata SQL Injection Attempt"; flow:to_server; content:"/api/v1/testDefinitions/listCount"; http_uri; content:"testPlatform="; http_uri; pcre:"/(UNION|SELECT|OR|1=1)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate vulnerable OpenMetadata instances from untrusted networks.
2. Implement a Web Application Firewall (WAF) with rules to block SQL injection patterns.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version of OpenMetadata once available.
• Apply the principle of least privilege to database accounts used by OpenMetadata.
• Conduct a code review to ensure all database queries use parameterized statements.

Workaround:

• If patching is not possible, disable the listCount endpoint or restrict access via network controls.

Valters IT