CVE-2024-28847: 
Java vulnerability analysis and mitigation

CVE-2024-28847 is a Spring Expression Language (SpEL) injection vulnerability discovered in OpenMetadata, affecting versions prior to 1.2.4. The vulnerability exists in the PUT /api/v1/events/subscriptions endpoint, where the AlertUtil::validateExpression method is called from EventSubscriptionRepository.prepare(), potentially leading to Remote Code Execution. The vulnerability was discovered with the help of CodeQL's Expression language injection query and was disclosed on March 15, 2024 (GitHub Advisory).

The vulnerability occurs when AlertUtil::validateExpression evaluates a SpEL expression using getValue with a StandardEvaluationContext, which by default allows the expression to access and interact with Java classes. The issue lies in the validation process where prepareInternal() is called before the authorization check, allowing the SpEL expression to be evaluated before proper authorization is verified. The vulnerability has been assigned a CVSS v3.1 score of 8.8 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (GitHub Advisory).

Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary code on the underlying operating system with root privileges. The vulnerability enables attackers to gain unauthorized access to Kubernetes workloads and potentially leverage them for malicious purposes, including cryptocurrency mining activities (Hacker News).

The vulnerability requires authentication to exploit, as only authenticated users have access to PUT/POST APIs for /api/v1/events/subscriptions. Attackers have been actively exploiting this vulnerability since early April 2024 to gain unauthorized access to Kubernetes workloads for cryptocurrency mining purposes (Hacker News).

The vulnerability has been patched in OpenMetadata version 1.2.4. Users are strongly advised to upgrade to this version or later. For those unable to upgrade immediately, it's recommended to implement strong authentication methods and avoid using default credentials (GitHub Advisory).

Microsoft's Threat Intelligence team has reported that threat actors are actively exploiting this vulnerability along with other OpenMetadata flaws since the start of April 2024. The exploitation attempts have been primarily focused on cryptocurrency mining activities in Kubernetes environments (Hacker News).