Ⓜ️ Metabase Pre-auth RCE
Earlier this week, it was reported that Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 has a vulnerability that allows attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. This vulnerability was designated as CVE-2023-38646.
Research:
https://blog.calif.io/p/reproducing-cve-2023-38646-metabase
PoC:
https://gist.github.com/testanull/a7beb2777bbf550f3cf533d2794477fe
#metabase #cve #poc #rce
Earlier this week, it was reported that Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 has a vulnerability that allows attackers to execute arbitrary commands on the server, at the server's privilege level. Authentication is not required for exploitation. This vulnerability was designated as CVE-2023-38646.
Research:
https://blog.calif.io/p/reproducing-cve-2023-38646-metabase
PoC:
https://gist.github.com/testanull/a7beb2777bbf550f3cf533d2794477fe
#metabase #cve #poc #rce
🔥8👍1