A critical zero-day SQL injection (SQLi) vulnerability in the Metabase business intelligence platform has been actively exploited to facilitate mass data exfiltration. The vulnerability arises from insufficient input sanitization within the query engine, permitting unauthenticated or low-privileged attackers to bypass security filters and execute arbitrary SQL commands against the application's backend database. This flaw enables attackers to bypass authorization controls via specific API endpoints, leading to the compromise of sensitive customer PII, administrative credentials, and potentially all connected data sources. Immediate remediation through vendor-supplied patches is required to mitigate the risk of full database takeover and secondary lateral movement into integrated data environments.

• Introduction/Overview
  • Critical zero-day SQLi vulnerability identified in the Metabase BI engine.
  • Active exploitation confirmed by threat actors targeting customer data.
  • Vulnerability impacts a wide range of Metabase deployments globally.
• Vulnerability Mechanics/Deep Dive
  • Flaw stems from inadequate sanitization of user-supplied inputs within the query execution engine.
  • Attackers utilize specialized SQLi payload patterns to bypass existing security filters.
  • Vulnerable API endpoints allow for the execution of arbitrary SQL queries without proper authorization.
  • The exploit bypasses standard application-level permissioning to reach the underlying database.
• Impact/Exploitation Status
  • Direct, unauthorized access to the Metabase internal application database.
  • Mass exfiltration of sensitive customer data, including PII and credentials.
  • Significant risk of compromise to all connected third-party data sources.
  • High-priority threat to organizations utilizing Metabase for business intelligence.
• Detection/Mitigation
  • Immediate upgrade to patched versions as specified in GitHub Advisory GHSA-vwf4-m7j8-wcjf.
  • Implementation of hardened query engine configurations to improve input validation.
  • Continuous monitoring of API traffic for anomalous SQL syntax or unauthorized query parameters.
  • Audit of internal database logs for evidence of unauthorized data access or exfiltration.