Metabase Zero-Day Turns Dashboards Into Data Heists at Framework and Tally
A critical flaw in the popular analytics tool let attackers walk in as admin. Customer names, emails and password hashes were taken before anyone knew the hole existed.
Key points
- Metabase disclosed on Thursday that its Cloud analytics platform was breached through a previously unknown flaw affecting versions 1.58 and above, rated a maximum severity 10.0.
- The bug is an unauthenticated SQL injection, meaning attackers could break in with no password and gain full administrator access to a customer's instance.
- Laptop maker Framework confirmed customer names, emails, phone numbers, billing and shipping addresses were stolen after its Metabase instance was accessed on August 3.
- Form-builder Tally says attackers reached user email addresses and hashed passwords, but not the forms themselves or the answers submitted.
- LexisNexis has told customers its Metabase API service was disrupted after unusual activity was spotted at a third-party vendor.
Metabase is analytics software that companies plug into their databases to build charts and dashboards. Somebody found a way to walk straight in as the boss.
On Thursday the company said its hosted service, Metabase Cloud, had been attacked using a security flaw nobody knew about yet. In the trade this is called a zero-day, meaning a bug the maker had no time to fix before the bad guys started using it.
The flaw is a SQL injection, which is one of the oldest tricks in web security: an attacker types database commands into a place that expects normal input, and the software runs them. Here it needed no login at all. From there the attacker could hand themselves administrator rights, read anything the dashboard could read, and grab the saved passwords Metabase uses to talk to other databases.
Metabase CEO Sameer Al-Sakran confirmed the attacks in a blog post. The company has not published a CVE identifier, the standard tracking number for a public flaw, but its own advisory rates the bug 10.0 out of 10 and says it was actively used against real customers.
Which versions are safe?
Any Metabase from version 1.58 onwards was at risk. The company has already patched its Cloud customers, but anyone running Metabase on their own servers needs to update by hand.
The minimum safe releases are laid out below.
| Branch | Minimum safe version |
|---|---|
| 0.58 | 0.58.24 |
| 0.59 | 0.59.21 |
| 0.60 | 0.60.17 |
| 0.61 | 0.61.11 |
| 0.62 | 0.62.9 |
| 0.63 | 0.63.5 |
If you cannot patch straight away, Metabase says to block access to the /api/session/reset_password endpoint. Attacks show up in logs as a POST request to that address returning a 400 error, followed by a successful GET to /api/user/current. Metabase warns those same logs may have been tampered with on breached systems.
Who has been hit so far?
Three companies have gone public. Framework, Tally and LexisNexis all use Metabase, and all three have told customers something went wrong.
Framework, the modular-laptop maker, told customers in a notice first reported by BleepingComputer that attackers reached its instance on August 3. Metabase warned Framework on August 6. The stolen data covers full names, email addresses, login IP addresses, phone numbers, and billing and shipping addresses. Business customers may also have lost company names, VAT and EIN tax numbers, and billing email addresses.
Tally, an online form builder, says the same attack reached its analytics environment on August 3. Attackers got user email addresses and password hashes, which are scrambled versions of passwords. Tally says the actual forms and the answers people submitted were stored separately and were not touched. The company has not yet said which hashing method it used or whether the hashes were salted, a detail that decides how easy those passwords are to crack.
LexisNexis told customers its Diligence, Metabase API and Newsdesk services were disrupted after unusual activity was found on servers run by a third-party vendor. It has not confirmed customer data was taken, and a forensic firm is investigating.
What should ordinary users do?
If you have a Framework or Tally account, change your password and turn on two-factor authentication if you have not already. Watch for phishing emails, which are fake messages pretending to be from the company, that quote real details like your address to seem convincing. Nothing about the breach forces you to act in a panic, but the leaked details are exactly the raw material scammers use for the next round.
