Metabase CVE-2023-38646远程代码执行漏洞

Description

PoC

None yet. Search at https://trap.biu.life/?ref=rss

References

• https://nvd.nist.gov/vuln/detail/CVE-2023-38646
• https://github.com/kh4sh3i/CVE-2023-38646
• https://www.exploit-db.com/exploits/51797
• https://www.assetnote.io/resources/research/chaining-our-way-to-pre-auth-rce-in-metabase-cve-2023-38646/
• https://www.assetnote.io/resources/research/advisory-metabase-pre-auth-rce-cve-2023-38646/
• https://blog.nsfocus.net/metabasecve-2023-38646/
• https://www.broadcom.com/support/security-center/attacksignatures/detail?asid=34306
• https://www.ox.security/blog/3-years-later-cve-2023-38646-still-haunts-thousands-of-metabase-deployments/
• https://dev.to/mohamed_aboelkheir/lessons-learned-1-one-line-of-code-can-make-your-application-vulnerable-pre-auth-rce-in-metabase-cve-2023-38646-17ic
• https://zhuanlan.zhihu.com/p/647355511

Related Vulnerabilities

• PoCCVE-2026-72898: Metabase - Unauthenticated SQL Injection
• metaBase reset_password 接口存在sql注入漏洞
• PoCMetabase SQL注入致远程代码执行漏洞
• PoCmetabase-installer-exposure: Metabase Installer - Exposure
• PoCCVE-2021-41277: Metabase - Local File Inclusion
• PoCCVE-2023-38646: Metabase < 0.46.6.1 - Remote Code Execution
• PoCCVE-2021-41277: Metabase 输入验证错误漏洞
• PoCCVE-2023-38646: Metabase 远程命令执行漏洞 RCE
• PoCmetabase-log4j-rce: Metabase - Remote Code Execution (Apache Log4j)
• Metabase validate 远程命令执行漏洞(CVE-2023-38646)
• Metabase H2 远程代码执行漏洞
• Metabase JDBC 远程代码执行漏洞（CVE-2023-38646）