Security Digest · Vulnerability record
CVE-2024-28253: OpenMetadata vulnerable to SpEL Injection in `PUT /api/v1/policies` (`GHSL-2023-252`)
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration.
CVSS 9.4 Critical EPSS 12.5% · p96
Should you act?
High exploit likelihood
EPSS ranks it in the top 5% of all CVEs for likely exploitation in the next 30 days. This signal is computed from CISA KEV, EPSS and CVSS data; it is not an editorial verdict.
- No confirmed exploitation. It is not in CISA’s KEV catalog and CISA’s SSVC assessment records no known exploitation. That can change quickly after a public write-up; re-check if you are affected.
- EPSS 12.5%, percentile 96: FIRST’s model estimates a 12.5% chance of exploitation activity in the next 30 days, higher than 96% of all scored CVEs (very high). EPSS is a probability, not a verdict.
- Remotely reachable with no login and no user interaction. If the vulnerable service is exposed to the internet, prioritize it.
- Only applies if your dependency tree includes
org.open-metadata:openmetadata-service(Maven) < 1.3.1, fixed in 1.3.1. Check your lockfile, including transitive dependencies.
What it is
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. CompiledRule::validateExpression is also called from PolicyRepository.prepare. prepare() is called from EntityRepository.prepareInternal() which, in turn, gets called from EntityResource.createOrUpdate(). Note that even though there is an authorization check (authorizer.authorize()), it gets called after prepareInternal() gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to /api/v1/policies which gets handled by PolicyResource.createOrUpdate(). This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as GHSL-2023-252. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
From the GitHub advisory
SpEL Injection in PUT /api/v1/policies (GHSL-2023-252)
Please note, only authenticated users have access to PUT / POST APIS for /api/v1/policies. Non authenticated users will not be able to access these APIs to exploit the vulnerability
CompiledRule::validateExpression is also called from PolicyRepository.prepare
prepare() is called from EntityRepository.prepareInternal() which, in turn, gets called from the EntityResource.createOrUpdate():
Note that even though there is an authorization check (authorizer.authorize()), it gets called after prepareInternal() gets called and therefore after the SpEL expression has been evaluated.
Weakness type: CWE-94.
Product: org.open-metadata:openmetadata-service (Maven) · Assigned by: GitHub_M · Published: 2024-03-15
Affected and fixed versions
| Ecosystem | Package | Vulnerable | First fixed |
|---|---|---|---|
| Maven | org.open-metadata:openmetadata-service | < 1.3.1 | 1.3.1 |
| Vendor | Product | Affected versions (per CVE record) |
|---|---|---|
| open-metadata | OpenMetadata | < 1.3.1 |
Severity scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| GitHub_M | 3.1 | 9.4 Critical | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
| GitHub | 3.1 | 9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
- Attack vector: network (remotely reachable)
- Attack complexity: low
- Privileges required: none (no login)
- User interaction: none
- Scope: unchanged
CVSS measures how bad a flaw is if exploited, not how likely exploitation is. Read it next to the exploitation data below.
Exploitation and urgency
- CISA KEV: not listed (no confirmed in-the-wild exploitation known to CISA).
- CISA SSVC assessment: exploitation none, automatable yes, technical impact total.
- FIRST EPSS (model of 2026-10-21): 12.53% probability of exploitation activity in the next 30 days; percentile 96.
Timeline
- — CVE record published by GitHub_M
- — GitHub-reviewed advisory GHSA-7vf4-x5m2-r6gr published (critical)
- — CVE record last updated
Sources and references
Original sources first. Version and fix details should always be confirmed against the vendor or project advisory.
Vulnerability records
- GitHub Advisory GHSA-7vf4-x5m2-r6gr github.com
- CVE.org record CVE-2024-28253 cve.org
- NVD entry CVE-2024-28253 nvd.nist.gov
Other references from the CVE record and advisory
- github.com github.com
- codeql.github.com codeql.github.com
- github.com github.com
- github.com github.com
- github.com github.com
- github.com github.com
- securitylab.github.com securitylab.github.com