SpEL Injection in `PUT /api/v1/policies` in OpenMetadata
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-94.
Summary
OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository, in-depth lineage, and seamless team collaboration. `CompiledRule::validateExpression` is also called from `PolicyRepository.prepare`. `prepare()` is called from `EntityRepository.prepareInternal()` which, in turn, gets called from `EntityResource.createOrUpdate()`. Note that even though there is an authorization check (`authorizer.authorize()`), it gets called after `prepareInternal()` gets called and therefore after the SpEL expression has been evaluated. In order to reach this method, an attacker can send a PUT request to `/api/v1/policies` which gets handled by `PolicyResource.createOrUpdate()`. This vulnerability was discovered with the help of CodeQL's Expression language injection (Spring) query and is also tracked as `GHSL-2023-252`. This issue may lead to Remote Code Execution and has been addressed in version 1.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| open-metadata | OpenMetadata | before 1.3.1 | 1.3.1 | Patch available | CNA |
| — | org.open-metadata:openmetadata-service (Maven) | before 1.3.1 | 1.3.1 | Patch available | GHSA-7vf4-x5m2-r6gr |
- OpenMetadata Vendoropen-metadata Affected before 1.3.1 Fixed in 1.3.1 Patch available CNA
- org.open-metadata:openmetadata-service (Maven) Vendor— Affected before 1.3.1 Fixed in 1.3.1 Patch available GHSA-7vf4-x5m2-r6gr
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:open-metadata:openmetadata:*:*:*:*:*:*:*:* | before 1.3.1 | Vulnerable | open-metadata |
- cpe:2.3:a:open-metadata:openmetadata:*:*:*:*:*:*:*:* Versions before 1.3.1 Vulnerable ·open-metadata
Remediation
- Fix · CNA OpenMetadata (open-metadata) Fixed in 1.3.1
- Fix · GHSA-7vf4-x5m2-r6gr org.open-metadata:openmetadata-service (Maven) Fixed in 1.3.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-28253
- 2026-10-03 Alias added: GHSA-7vf4-x5m2-r6gr
References
Advisory 3
Other 6
- https://codeql.github.com/codeql-query-help/java/java-spel-expression-injection
- https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/EntityRepository.java#L693
- https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/EntityResource.java#L219
- https://github.com/open-metadata/OpenMetadata/blob/b6b337e09a05101506a5faba4b45d370cc3c9fc8/openmetadata-service/src/main/java/org/openmetadata/service/resources/policies/PolicyResource.java#L365
- https://github.com/open-metadata/OpenMetadata/blob/main/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/PolicyRepository.java#L113
- https://github.com/open-metadata/OpenMetadata
More open-metadata Openmetadata vulnerabilities
- TI-2024-18814 Authentication Bypass in OpenMetadata CVSS 3.1CRITICAL 9.8
- TI-2024-19050 SpEL Injection in `GET /api/v1/policies/validation/condition/<expr>` in OpenMetadata CVSS 3.1HIGH 8.8
- TI-2024-19049 SpEL Injection in `PUT /api/v1/events/subscriptions` in OpenMetadata CVSS 3.1HIGH 8.8
- TI-2024-18813 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata CVSS 3.1HIGH 8.8
- TI-2026-17854 OpenMetadata Server-Side Template Injection (SSTI) in FreeMarker email templates that leads to RCE CVSS 4.0HIGH 8.5
- TI-2024-36809 OpenMetadata <=1.4.1 is vulnerable to SQL Injection. CVSS 3.1HIGH 8.8
Sources
- CVE-2024-28253 · CVE Program
- CVE-2024-28253 · NVD
- FIRST EPSS
- GHSA-7vf4-x5m2-r6gr · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences