CVE-2024-28847 Information

Description

OpenMetadata is a unified platform for discovery observability and governance powered by a central metadata repository in-depth lineage and seamless team collaboration. Similarly to the GHSL-2023-250 issue AlertUtil::validateExpression is also called from EventSubscriptionRepository.prepare() which can lead to Remote Code Execution. prepare() is called from EntityRepository.prepareInternal() which in turn gets called from EntityResource.createOrUpdate(). Note that even though there is an authorization check (authorizer.authorize()) it gets called after prepareInternal() gets called and therefore after the SpEL expression has been evaluated. In order to reach this method an attacker can send a PUT request to /api/v1/events/subscriptions which gets handled by EventSubscriptionResource.createOrUpdateEventSubscription(). This vulnerability was discovered with the help of CodeQL’s Expression language injection (Spring) query. This issue may lead to Remote Code Execution and has been addressed in version 1.2.4. Users are advised to upgrade. There are no known workarounds for this vulnerability. This issue is also tracked as GHSL-2023-251.

Reference

https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-8p5r-6mvv-2435 https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EntityRepository.java#L693 https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EventSubscriptionRepository.java#L69-L83 https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/EntityResource.java#L219 https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/events/subscription/EventSubscriptionResource.java#L289