CVE-2022-24853

File system exposure in Metabase

Medium5.9EPSS 2.5%

Published: 14 Apr 2022
Updated: 22 Apr 2025
Reserved: 10 Feb 2022
Assigned by: GitHub_M

Description

Metabase is an open source business intelligence and analytics application. Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately. The following patches (or greater versions) are available: 0.42.4 and 1.42.4, 0.41.7 and 1.41.7, 0.40.8 and 1.40.8.

Scores

CVSS scores of CVE-2022-24853, by who scored it
Scored by	CVSS	Score	Vector
GitHub_MCNA (assigner)	3.1	Medium5.9	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
NVDNVD · Modified	3.1	Medium5.3	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

EPSS (exploitation in 30 days): 2.5% · top 15% of all CVEs (7 Nov 2026)
CISA SSVC: Exploitation: poc · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 5.9.

Weakness

CWE-200: Exposure of Sensitive Information to an Unauthorized Actor (opens in a new tab)All about CWE-200 and its CVEs

Affected products

metabase · metabase
- affected >= 1.40.0, < 1.40.7
- affected >= 0.40.0, < 0.40.7
- affected >= 1.41.0, < 1.41.6
- affected >= 0.41.0, < 0.41.6
- affected >= 1.42.0, < 1.42.3
- affected >= 0.42.0, < 0.42.3

References (3)

https://github.com/metabase/metabase/security/advisories/GHSA-5cfq-582c-c38m (opens in a new tab)x_refsource_CONFIRMx_transferred
https://www.qomplx.com/qomplx-knowledge-ntlm-relay-attacks-explained/ (opens in a new tab)x_refsource_MISCx_transferred
https://secure77.de/metabase-ntlm-relay-attack/ (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

Badge for a README or a ticket

[![CVE-2022-24853](https://trackcve.app/badge/CVE-2022-24853.svg)](https://trackcve.app/cve/CVE-2022-24853)

Record last updated 22 Apr 2025, 18:15 UTC.