automatic module_metadata_base.json update

Author: msjenkins-r7

db/modules_metadata_base.json

@@ -78128,6 +78128,70 @@
     "session_types": false,
     "needs_cleanup": null
   },
+  "exploit_linux/http/openmetadata_auth_bypass_rce": {
+    "name": "OpenMetadata authentication bypass and SpEL injection exploit chain",
+    "fullname": "exploit/linux/http/openmetadata_auth_bypass_rce",
+    "aliases": [
+
+    ],
+    "rank": 600,
+    "disclosure_date": "2024-03-15",
+    "type": "exploit",
+    "author": [
+      "h00die-gr3y <[email protected]>",
+      "Alvaro Muñoz alias pwntester (https://github.com/pwntester)"
+    ],
+    "description": "OpenMetadata is a unified platform for discovery, observability, and governance powered\n          by a central metadata repository, in-depth lineage, and seamless team collaboration.\n          This module chains two vulnerabilities that exist in the OpenMetadata aplication.\n          The first vulnerability, CVE-2024-28255, bypasses the API authentication using JWT tokens.\n          It misuses the `JwtFilter` that checks the path of the url endpoint against a list of excluded\n          endpoints that does not require authentication. Unfortunately, an attacker may use Path Parameters\n          to make any path contain any arbitrary strings that will match the excluded endpoint condition\n          and therefore will be processed with no JWT validation allowing an attacker to bypass the\n          authentication mechanism and reach any arbitrary endpoint.\n          By chaining this vulnerability with CVE-2024-28254, that allows for arbitrary SpEL injection\n          at endpoint `/api/v1/events/subscriptions/validation/condition/<expression>`, attackers\n          are able to run arbitrary commands using Java classes such as `java.lang.Runtime` without any\n          authentication.\n          OpenMetadata versions `1.2.3` and below are vulnerable.",
+    "references": [
+      "CVE-2024-28255",
+      "CVE-2024-28254",
+      "URL-https://securitylab.github.com/advisories/GHSL-2023-235_GHSL-2023-237_Open_Metadata/",
+      "URL-https://attackerkb.com/topics/f19fXpZn62/cve-2024-28255",
+      "URL-https://ethicalhacking.uk/unmasking-cve-2024-28255-authentication-bypass-in-openmetadata/"
+    ],
+    "platform": "Linux,Unix",
+    "arch": "cmd",
+    "rport": 8585,
+    "autofilter_ports": [
+      80,
+      8080,
+      443,
+      8000,
+      8888,
+      8880,
+      8008,
+      3000,
+      8443
+    ],
+    "autofilter_services": [
+      "http",
+      "https"
+    ],
+    "targets": [
+      "Automatic"
+    ],
+    "mod_time": "2024-08-06 21:00:06 +0000",
+    "path": "/modules/exploits/linux/http/openmetadata_auth_bypass_rce.rb",
+    "is_install_path": true,
+    "ref_name": "linux/http/openmetadata_auth_bypass_rce",
+    "check": true,
+    "post_auth": false,
+    "default_credential": false,
+    "notes": {
+      "Stability": [
+        "crash-safe"
+      ],
+      "Reliability": [
+        "repeatable-session"
+      ],
+      "SideEffects": [
+        "ioc-in-logs",
+        "artifacts-on-disk"
+      ]
+    },
+    "session_types": false,
+    "needs_cleanup": null
+  },
   "exploit_linux/http/opennms_horizon_authenticated_rce": {
     "name": "OpenNMS Horizon Authenticated RCE",
     "fullname": "exploit/linux/http/opennms_horizon_authenticated_rce",