CVE-2023-38646: 
NixOS vulnerability analysis and mitigation

CVE-2023-38646 affects Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1. The vulnerability allows attackers to execute arbitrary commands on the server at the server's privilege level without requiring authentication. The vulnerability was discovered in July 2023, and fixed versions were released on July 21, 2023. The affected versions include all versions up to 0.43.7.2, versions from 0.44.0 to 0.44.7.1, versions from 0.45.0 to 0.45.4.1, and versions from 0.46.0 to 0.46.6.1 (NVD, Assetnote Blog).

The vulnerability received a CVSS v3.1 Base Score of 9.8 (Critical) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H, indicating network accessibility, low attack complexity, no privileges required, and no user interaction needed. The vulnerability chain involves obtaining a setup token from /api/session/properties endpoint and using it with a special endpoint that validates DB connections. The attack leverages an SQL injection vulnerability in the H2 database driver to achieve code execution (Assetnote Blog).

The vulnerability allows attackers to execute arbitrary commands with the same privileges as the Metabase server. Given that Metabase is designed to connect to sensitive datasources, a successful exploit could lead to access to critical parts of an organization's network and sensitive data sources. At the time of discovery, approximately 20,000 instances of Metabase were exposed on the external internet (Assetnote Blog).

The primary mitigation is to upgrade to the fixed versions: 0.46.6.1, 0.45.4.1, 1.45.4.1, 0.44.7.1, 1.44.7.1, 0.43.7.2, or 1.43.7.2. Additional security measures include placing Metabase behind a VPN, using reverse proxies with authentication, and ensuring the instance is not directly exposed to the internet. Organizations should also consider implementing network isolation and using read-only credentials for database access (Metabase Advisory, Assetnote Blog).

The vulnerability generated significant discussion in the security community, with many experts emphasizing the importance of proper isolation for analytics tools. Security researchers and practitioners recommended against allowing direct access to production databases through analytics visualization tools like Metabase, suggesting instead to use separate analytics databases with aggregated, anonymized data (HN Discussion).