Detections
Analytics
Metabase 0.40.x < 0.40.8 / 0.41.x < 0.41.7 / 0.42.x < 0.42.4 / 1.40.x < 1.40.8 / 1.41.x < 1.41.7 / 1.42.x < 1.42.4
medium Nessus Plugin ID 261764
Language:
Synopsis
The remote host is affected by a vulnerability.Description
The version of Metabase installed on the remote host is prior to 1.42.4. It is, therefore, affected by multiple vulnerabilities.- Metabase has a proxy to load arbitrary URLs for JSON maps as part of our GeoJSON support. While we do validation to not return contents of arbitrary URLs, there is a case where a particularly crafted request could result in file access on windows, which allows enabling an `NTLM relay attack`, potentially allowing an attacker to receive the system password hash. If you use Windows and are on this version of Metabase, please upgrade immediately.
Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.
Solution
Upgrade to Metabase version 1.42.4 or later.See Also
https://www.qomplx.com/qomplx-knowledge-ntlm-relay-attacks-explained/
https://secure77.de/metabase-ntlm-relay-attack/
Plugin Details
Severity: Medium
ID: 261764
File Name: metabase_CVE-2022-24853.nasl
Version: 1.1
Type: remote
Family: CGI abuses
Published: 9/9/2025
Updated: 9/9/2025
Supported Sensors: Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 4.4
CVSS v2
Risk Factor: Medium
Base Score: 5.4
Vector: CVSS2#AV:N/AC:H/Au:N/C:C/I:N/A:N
CVSS Score Source: CVE-2022-24853
CVSS v3
Risk Factor: Medium
Base Score: 5.3
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
Vulnerability Information
CPE: cpe:/a:metabase:metabase
Required KB Items: Host/OS, installed_sw/Metabase
Patch Publication Date: 4/14/2022
Vulnerability Publication Date: 4/14/2022
Reference Information
CVE: CVE-2022-24853