CVE-2021-41277

GeoJSON URL validation can expose server files and environment variables to unauthorized users

Basic Information

CVE State: PUBLISHED
Reserved Date: September 15, 2021
Published Date: November 17, 2021
Last Updated: November 13, 2024
Vendor: metabase
Product: metabase
Description: Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

CVSS Scores

CVSS v3.1

10.0 - CRITICAL

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L

SSVC Information

Exploitation: active
Automatable: Yes
Technical Impact: partial

Exploit Status

Exploited in the Wild: Yes (added 2024-11-12 00:00:00 UTC) Source
Proof of Concept Available: Yes (added 2021-11-23 18:01:23 UTC) Source

References

https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0

Known Exploited Vulnerability Information

Source	Added Date
CISA	2024-11-12 00:00:00 UTC

Scanner Integrations

Scanner	URL	Date Detected
Nuclei	https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-41277.yaml	2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

sasukeourad/CVE-2021-41277_SSRF

Type: github • Created: 2022-01-10 01:52:10 UTC • Stars: 4

CVE-2021-41277 can be extended to an SSRF

zer0yu/CVE-2021-41277

Type: github • Created: 2021-12-06 08:52:32 UTC • Stars: 9

Vulnmachines/Metabase_CVE-2021-41277

Type: github • Created: 2021-11-23 18:01:23 UTC • Stars: 4

z3n70/CVE-2021-41277

Type: github • Created: 2021-11-22 18:06:11 UTC • Stars: 5

simple program for exploit metabase

tahtaciburak/CVE-2021-41277

Type: github • Created: 2021-11-21 11:38:08 UTC • Stars: 11

PoC for CVE-2021-41277

Seals6/CVE-2021-41277

Type: github • Created: 2021-11-21 11:04:44 UTC • Stars: 9

Metabase任意文件读取漏洞批量扫描工具