Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.

The version of Metabase installed on the remote host is prior to 1.40.5. It is, therefore, affected by a local file inclusion vulnerability.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

A local file inclusion vulnerability exists in Metabase due to a security issue present in GeoJSON map support that leads to a local file inclusion vulnerabiltity. An unauthenticated, remote attacker can exploit this, via a specially crafted HTTP GET request, to download arbitrary files with root privileges and examine environment variables.

Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables) because URLs were not validated prior to being loaded.

ID	Name	Product	Family	Type	Severity
261765	Metabase < 1.40.5	Nessus	CGI abuses	Remote	high
163589	Metabase LFI (CVE-2021-41277)	Nessus	Web Servers	Remote	high
113073	Metabase GeoJSON Local File Inclusion	Web App Scanning	Component Vulnerability	Check Based	high

Detections

Analytics

CVE-2021-41277

high

Tenable Plugins

high

high

high