High severity · published Nov 17, 2021
CVE-2021-41277
GeoJSON URL validation can expose server files and environment variables to unauthorized users
In wildKEV
7.5
CVSS
97.2%
EPSS
Yes
On KEV
Description
Metabase is an open source data analytics platform. In affected versions a security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded. This issue is fixed in a new maintenance release (0.40.5 and 1.40.5), and any subsequent release after that. If you’re unable to upgrade immediately, you can mitigate this by including rules in your reverse proxy or load balancer or WAF to provide a validation filter before the application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)97.2% · higher than 100% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 12, 2024
Federal remediation dueDec 3, 2024
Ransomware campaign useNot known
Affected products
Which versions
ME
metabase · metabase
< 0.40.5; >= 1.0.0, < 1.40.5 · source: vendor, NVD, KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2021-41277
CVE.org
https://www.cve.org/CVERecord?id=CVE-2021-41277
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr
x_refsource_MISC
https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0
More from metabase
10.0
CVE-2026-72898
Metabase SQL injection via password reset endpoint
10.0
CVE-2026-72899
Metabase SQL injection via public card or dashboard
9.8
CVE-2023-37470
Metabase is an open-source business intelligence and analytics platform
9.8
CVE-2023-38646
Metabase open source before 0.46.6.1 and Metabase Enterprise before 1.46.6.1 allow attackers to execute arbitrary commands on the server, at the server's privilege level
9.6
CVE-2023-32680
Metabase is an open source business analytics engine