CVE-2024-28254: 
Java vulnerability analysis and mitigation

OpenMetadata is a unified platform for discovery, observability, and governance powered by a central metadata repository. The AlertUtil::validateExpression method evaluates an SpEL expression using getValue which by default uses the StandardEvaluationContext, allowing the expression to reach and interact with Java classes such as java.lang.Runtime, leading to Remote Code Execution. The vulnerability was discovered on March 15, 2024, and affects versions prior to 1.2.4 (GitHub Advisory).

The vulnerability exists in the /api/v1/events/subscriptions/validation/condition/ endpoint which passes user-controlled data to AlertUtil::validateExpession. The issue is compounded by a missing authorization check since Authorizer.authorize() is never called in the affected path, allowing any authenticated non-admin user to trigger this endpoint and evaluate arbitrary SpEL expressions. The vulnerability has been assigned a CVSS score of 8.8 HIGH with vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (GitHub Advisory).

This vulnerability allows authenticated non-admin users to execute arbitrary system commands on the underlying operating system through remote code execution. The high CVSS score indicates severe potential impact on system confidentiality, integrity, and availability (GitHub Advisory).

The vulnerability is being actively exploited in the wild since early April 2024. Attackers are targeting Kubernetes clusters running OpenMetadata to gain unauthorized access to workloads and leverage them for cryptocurrency mining activity (Hacker News).

The vulnerability has been patched in OpenMetadata version 1.2.4. Users are advised to upgrade to this version or later. There are no known workarounds for this vulnerability. The fix involves using SimpleEvaluationContext to exclude references to Java types, constructors, and bean references (GitHub Advisory).

Microsoft Threat Intelligence team reported that the flaws have been weaponized since the start of April 2024. The OpenMetadata community has acknowledged the security implications and quickly addressed the vulnerabilities in January 2024 following disclosure on December 14, 2023 (Hacker News).