Description
OpenMetadata中存在代码执行漏洞，此漏洞是由于condition接口未充分验证用户输入的数据所导致的。
OpenMetadata CVE-2024-28848 代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://avd.aliyun.com/detail?id=AVD-2024-28848
https://www.venustech.com.cn/new_type/aqtg/20240416/27318.html
https://wh0am1i.com/2024/04/17/OpenMetadata-auth-bypass-and-spel-injection/index.html
https://www.anquanke.com/post/id/295799
https://www.ddpoc.com/DVB-2024-6657.html
https://nvd.nist.gov/vuln/detail/cve-2024-28848
https://open-metadata.org/cve-list
https://www.microsoft.com/en-us/security/blog/2024/04/17/attackers-exploiting-new-critical-openmetadata-vulnerabilities-on-kubernetes-clusters/
https://www.incibe.es/en/incibe-cert/early-warning/vulnerabilities/cve-2024-28848
https://github.com/open-metadata/OpenMetadata/security/advisories/GHSA-5xv3-fm7g-865r
https://securitylab.github.com/advisories/GHSL-2023-235_GHSL-2023-237_Open_Metadata/
https://www.broadcom.com/support/security-center/protection-bulletin/multiple-vulnerabilities-in-openmetadata
https://blog.open-metadata.org/openmetadata-cve-2024-xxxx-update-b96994c2b212
https://qkl.seebug.org/category/code-execution