CVE-2025-50467

Executive Summary

CVE-2025-50467 is a critical SQL Injection vulnerability affecting OpenMetadata versions up to and including 1.4.4. The flaw resides in the listCount function within the TestDefinitionDAO interface, where the supportedDataTypeParam parameter is improperly sanitized, allowing an attacker to inject arbitrary SQL queries. This can lead to unauthorized extraction of sensitive data from the underlying database, including user credentials, metadata, and configuration secrets. The vulnerability is currently unpatched, and no public proof-of-concept or exploit code has been released. Given the nature of OpenMetadata as a data cataloging and governance platform, exploitation could result in a significant data breach.

Supply Chain & Package Security

OpenMetadata is a Java-based application distributed via Docker images and source code. The vulnerability exists in the core application code, not in a third-party package. However, organizations using OpenMetadata should verify the integrity of their deployment artifacts and ensure they are not running a vulnerable version.

CVSS Breakdown & Threat Level

The CVSS score is currently listed as 0.0, indicating that a full vector has not been assigned by NVD. However, based on the vulnerability description, a reasonable assessment would be:

• Attack Vector (AV): Network (N) – The vulnerability is exploitable remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): Low (L) – An attacker likely needs some level of access to the application, but not administrative.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The vulnerability does not affect other components.
• Confidentiality (C): High (H) – Full database read access is possible.
• Integrity (I): None (N) – The vulnerability is read-only.
• Availability (A): None (N) – No impact on availability.

Estimated CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N Estimated Base Score: 6.5 (Medium)

Threat Level: High. While the CVSS score is medium, the potential for data exfiltration from a metadata platform makes this a serious threat.

Deep Dive & Mechanics

The vulnerability is located in the TestDefinitionDAO interface, specifically in the listCount function. This function is used to count the number of test definitions that match certain criteria. The supportedDataTypeParam parameter is used to filter test definitions based on the data type they support.

The root cause is a failure to properly sanitize or parameterize the supportedDataTypeParam input before incorporating it into a SQL query. Instead of using a prepared statement with a bind variable, the application likely concatenates the user-supplied value directly into the SQL string.

Example of vulnerable code logic (pseudocode):

// Vulnerable approach
String sql = "SELECT COUNT(*) FROM test_definition WHERE supported_data_type = '" + supportedDataTypeParam + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(sql);

An attacker can provide a value like:

' OR '1'='1

This would transform the query into:

SELECT COUNT(*) FROM test_definition WHERE supported_data_type = '' OR '1'='1'

This would return the total count of all test definitions, bypassing the intended filter. More sophisticated payloads could be used to extract data from other tables using UNION-based SQL injection.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable pattern and the expected fix.

Vulnerable Code (Conceptual):

// OpenMetadata <= 1.4.4
public int listCount(String supportedDataTypeParam) {
    String sql = "SELECT COUNT(*) FROM test_definition WHERE supported_data_type = '" + supportedDataTypeParam + "'";
    // Execute query
}

Patched Code (Expected):

// Patched version (hypothetical)
public int listCount(String supportedDataTypeParam) {
    String sql = "SELECT COUNT(*) FROM test_definition WHERE supported_data_type = ?";
    PreparedStatement pstmt = connection.prepareStatement(sql);
    pstmt.setString(1, supportedDataTypeParam);
    ResultSet rs = pstmt.executeQuery();
    // Process results
}

The fix involves using a PreparedStatement with a bind variable (?) to ensure the input is treated as data, not executable code.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to an OpenMetadata instance (version <= 1.4.4) with a valid user session (low privileges may be sufficient).
• Knowledge of the API endpoint that triggers the listCount function.

Exploitation Steps:

1. Identify the vulnerable endpoint. The listCount function is likely exposed via a REST API. Look for endpoints related to test definitions, such as:

   GET /api/v1/testDefinitions/listCount?supportedDataTypeParam=STRING
   

2. Craft a SQL injection payload. Use a UNION-based injection to extract data from other tables. For example, to list all tables in the database:

   GET /api/v1/testDefinitions/listCount?supportedDataTypeParam=' UNION SELECT table_name FROM information_schema.tables --
   

3. Extract sensitive data. Once you confirm the injection works, target tables like user_entity or bot_entity to extract credentials or tokens.

Example cURL command:

curl -X GET "http://target.openmetadata.com/api/v1/testDefinitions/listCount?supportedDataTypeParam=' UNION SELECT password_hash FROM user_entity --"

Note: No public exploit code is available. The above is a conceptual demonstration.

Blue Team (Defense & Detection)

Detection Strategy:

• Monitor for unusual SQL query patterns in database logs.
• Look for API requests to /api/v1/testDefinitions/listCount with suspicious supportedDataTypeParam values (e.g., containing SQL keywords like UNION, SELECT, OR).

Honeypot Setup:

• Deploy a decoy OpenMetadata instance with a fake database containing honeytokens.
• Monitor for any access to the listCount endpoint with non-standard parameters.

Mitigation Steps:

• Immediately restrict network access to the OpenMetadata API to trusted IPs.
• Implement a Web Application Firewall (WAF) rule to block SQL injection patterns.
• If possible, apply a temporary patch by modifying the source code to use prepared statements.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP requests to /api/v1/testDefinitions/listCount containing SQL keywords in the supportedDataTypeParam parameter.
• Unusual database queries originating from the OpenMetadata application server.

File IOCs:

• Modified TestDefinitionDAO.java file (if attacker has code access).
• Suspicious log entries in openmetadata.log containing SQL errors or injection attempts.

Behavioral IOCs:

• Unexpected database reads from tables like user_entity, bot_entity, or information_schema.
• Anomalous increase in database connections from the OpenMetadata service.

Detection Engineering

YARA Rule

rule CVE_2025_50467_SQLi_OpenMetadata {
    meta:
        description = "Detects SQL injection attempts targeting CVE-2025-50467 in OpenMetadata"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-50467"
    strings:
        $sqli1 = "supportedDataTypeParam=" nocase
        $sqli2 = "UNION" nocase
        $sqli3 = "SELECT" nocase
        $sqli4 = "OR" nocase
        $sqli5 = "1=1" nocase
    condition:
        $sqli1 and (any of ($sqli2, $sqli3, $sqli4, $sqli5))
}

Sigma Rule

title: SQL Injection Attempt Against OpenMetadata listCount Endpoint
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SQL injection attempts targeting the supportedDataTypeParam parameter in OpenMetadata's listCount function.
author: Valters IT
date: 2025-04-10
references:
    - CVE-2025-50467
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-query|contains:
            - "supportedDataTypeParam="
        cs-uri-query|contains|all:
            - "UNION"
            - "SELECT"
    condition: selection
falsepositives:
    - Legitimate use of the word "UNION" in a data type name (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-50467 SQL Injection Attempt - OpenMetadata listCount"; flow:to_server,established; content:"GET"; http_method; content:"/api/v1/testDefinitions/listCount"; http_uri; content:"supportedDataTypeParam="; http_uri; pcre:"/(UNION|SELECT|OR|1=1)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the vulnerable instance: If possible, take the OpenMetadata server offline or restrict network access to trusted users only.
2. Apply a WAF rule: Block requests containing SQL keywords in the supportedDataTypeParam parameter.
3. Monitor logs: Review database and application logs for signs of exploitation.

Long-term Fix:

• Upgrade: Once a patched version is released (e.g., > 1.4.4), upgrade immediately.
• Code Fix: If you have access to the source code, modify the listCount function to use prepared statements as shown in the "Patched Code" section.
• Security Hardening: Ensure the database user used by OpenMetadata has minimal privileges (e.g., read-only access to necessary tables, no access to information_schema).

Workaround:

• Disable the listCount endpoint by modifying the API routing configuration, if possible.

Valters IT
Securing Digital Frontiers