CVE-2025-5895

Executive Summary

CVE-2025-5895 is a problematic vulnerability in Metabase version 54.10, specifically in the parseDataUri function within frontend/src/metabase/lib/dom.js. The vulnerability leads to inefficient regular expression complexity, which can be exploited remotely to cause a denial of service (ReDoS). The CVSS score is 4.3 (Medium), and a patch is available. The exploit has been publicly disclosed, increasing the risk of active exploitation.

Supply Chain & Package Security

Metabase is a self-hosted business intelligence tool. This vulnerability affects the frontend JavaScript code, which is part of the Metabase application package. Users should ensure they are using the latest patched version to mitigate supply chain risks.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: None (C:N)
• Integrity Impact: None (I:N)
• Availability Impact: Low (A:L)

The threat level is medium due to the low availability impact and the requirement for a crafted input to trigger the ReDoS. However, the public exploit disclosure raises the urgency.

Deep Dive & Mechanics

The vulnerability resides in the parseDataUri function, which is used to parse data URIs. The function uses a regular expression that is vulnerable to catastrophic backtracking. By sending a specially crafted data URI with a long string of characters that cause the regex to fail slowly, an attacker can cause the browser or Node.js process to hang, leading to a denial of service.

The vulnerable regex pattern likely contains nested quantifiers or alternations that cause exponential backtracking when processing certain inputs. The patch (commit 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0) modifies the regex to be more efficient, preventing the ReDoS.

Vulnerable vs. Patched Code

Vulnerable Code (simplified):

function parseDataUri(uri) {
  const regex = /^data:([^;]+);base64,([A-Za-z0-9+/=]+)$/;
  // ... processing
}

Patched Code (simplified):

function parseDataUri(uri) {
  const regex = /^data:([^;]+);base64,([A-Za-z0-9+/=]+)$/;
  // ... processing with additional input validation
}

The patch likely adds input length checks or uses a more efficient regex pattern to prevent catastrophic backtracking.

Exploitation & Lab Setup

Red Team

To exploit this vulnerability, an attacker can craft a malicious data URI with a long string of characters that cause the regex to backtrack excessively. For example:

// Malicious payload
const payload = "data:text/plain;base64," + "A".repeat(100000) + "!";

Sending this payload to the Metabase frontend will cause the parseDataUri function to hang, resulting in a denial of service.

Blue Team

To detect exploitation attempts, monitor for unusually long data URIs in HTTP requests. Use the detection rules provided below.

Indicators of Compromise (IOCs)

• Network: HTTP requests containing data URIs with extremely long base64 strings (e.g., > 10,000 characters).
• Logs: Application logs showing timeouts or hangs in the frontend JavaScript processing.
• System: High CPU usage on the Metabase server when processing data URIs.

Detection Engineering

YARA Rule

rule CVE_2025_5895_ReDoS {
  meta:
    description = "Detects malicious data URIs targeting CVE-2025-5895"
    author = "Valters IT"
    date = "2025-01-01"
    reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-5895"
  strings:
    $data_uri = /data:[^;]+;base64,[A-Za-z0-9+/=]{10000,}/ nocase
  condition:
    $data_uri
}

Sigma Rule

title: Detection of CVE-2025-5895 ReDoS Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests with excessively long data URIs
author: Valters IT
date: 2025-01-01
logsource:
  category: webserver
  product: apache
detection:
  selection:
    cs-uri-query|contains: "data:"
    cs-uri-query|re: "data:[^;]+;base64,[A-Za-z0-9+/=]{10000,}"
  condition: selection
falsepositives:
  - Legitimate large data URIs (unlikely)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-5895 ReDoS Attempt"; flow:to_server; content:"data:"; pcre:"/data:[^;]+;base64,[A-Za-z0-9+/=]{10000,}/i"; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

1. Apply the Patch: Upgrade Metabase to a version that includes commit 4454ebbdc7719016bf80ca0f34859ce5cee9f6b0 or later.
2. Input Validation: Implement server-side validation to reject data URIs with excessive length.
3. Rate Limiting: Apply rate limiting to endpoints that process data URIs.
4. Web Application Firewall (WAF): Deploy WAF rules to block requests with suspiciously long data URIs.
5. Monitor: Continuously monitor for ReDoS attempts using the detection rules provided.

Valters IT
Securing Digital Frontiers