Description
OpenMetadata中存在代码执行漏洞，此漏洞是由于condition接口未充分验证用户输入的数据所导致的。
OpenMetadata CVE-2024-28254 代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/cve-2024-28254
https://open-metadata.org/cve-list
https://securitylab.github.com/advisories/GHSL-2023-235_GHSL-2023-237_Open_Metadata/
https://www.broadcom.com/support/security-center/protection-bulletin/multiple-vulnerabilities-in-openmetadata
https://www.vicarius.io/vsociety/posts/authentication-bypass-with-path-parameter-in-openmetadata-cve-2024-28255
https://synscan.net/vuln/cve-2024-28254
https://www.microsoft.com/en-us/security/blog/2024/04/17/attackers-exploiting-new-critical-openmetadata-vulnerabilities-on-kubernetes-clusters/
https://www.venustech.com.cn/new_type/aqtg/20240416/27318.html
https://wh0am1i.com/2024/04/17/OpenMetadata-auth-bypass-and-spel-injection/index.html
https://www.anquanke.com/post/id/295799
https://access.redhat.com/security/cve/cve-2024-28254
https://docs.devguard.org/vulnerability-database/CVE-2024-28254/