CVE-2024-28848: 
Java vulnerability analysis and mitigation

OpenMetadata, a unified platform for discovery, observability, and governance powered by a central metadata repository, contains a critical vulnerability identified as CVE-2024-28848. The vulnerability was discovered in the CompiledRule::validateExpression method, which evaluates a Spring Expression Language (SpEL) expression using a StandardEvaluationContext. This flaw allows the expression to interact with Java classes such as java.lang.Runtime, potentially leading to Remote Code Execution. The vulnerability was discovered with the help of CodeQL's Expression language injection query and is tracked as GHSL-2023-236. The issue was disclosed on March 15, 2024, and has been resolved in version 1.2.4 (GitHub Advisory).

The vulnerability exists in the /api/v1/policies/validation/condition/ endpoint, which passes user-controlled data to CompiledRule::validateExpession. The flaw is compounded by a missing authorization check, as Authorizer.authorize() is never called in the affected path. This allows any authenticated non-admin user to trigger this endpoint and evaluate arbitrary SpEL expressions. The vulnerability has been assigned a CVSS score of 8.8 HIGH with the vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (GitHub Advisory).

The vulnerability enables authenticated users to execute arbitrary system commands on the underlying operating system. Attackers have been observed exploiting this vulnerability to infiltrate Kubernetes environments for cryptomining purposes. According to Wiz data, approximately 5% of cloud environments have publicly exposed resources vulnerable to this vulnerability (Wiz Report).

The vulnerability is being actively exploited in the wild since the start of April 2024. Attackers are targeting internet-exposed OpenMetadata workloads that have been left unpatched to gain code execution on containers running the OpenMetadata image. Upon gaining initial access, threat actors perform reconnaissance activities to gather information about the network configuration, operating system version, and environment variables before deploying crypto-mining malware (Hacker News).

Users are advised to upgrade to OpenMetadata version 1.2.4 or later, which contains the fix for this vulnerability. The recommended remediation involves using SimpleEvaluationContext to exclude references to Java types, constructors, and bean references. Additionally, organizations should implement strong authentication methods and avoid using default credentials (GitHub Advisory).

Microsoft's Threat Intelligence team has been actively monitoring the exploitation of this vulnerability and has observed attackers using it as part of a broader campaign targeting Kubernetes environments. The security community has emphasized the importance of patching this vulnerability quickly, particularly given its active exploitation in cryptomining operations (Hacker News).