To exploit customer instances in data theft hacks, a critical Metabase SQL injection flaw was abused in zero day attacks. The vulnerability impacted Tally and Framework.

Metabase revealed the attacks last week and warned that its Metabase Cloud SaaS platform was hacked via an earlier unknown bug impacting variants 1.58 and above. Metabase warned that self-hosted deployments may also be vulnerable.

In a blogpost, Metabase CEO, Sameer Al-Sakran said that, “"We recently identified that Metabase Cloud was attacked by someone utilizing an unknown ("0-day") security vulnerability in versions 1.58 and above."

Metabase stopped the endpoints used for the attack and released a fix for the flaw. 

"The vulnerability is an unauthenticated SQL injection flaw in Metabase that can ultimately give a remote attacker administrator access to a customer's instance."

Although Metabase has not given the flaw a CVE identifier, its security advisor labels it as Critical with CVSS score of 10.0 and acknowledges that it has been actively exploited.

"This is a CRITICAL vulnerability that allows an unauthenticated remote attacker to inject arbitrary SQL into the Metabase application database, which can give them administrator access to the instance,” said a GitHub security advisory.

"From there, the attacker could change the application configuration, steal stored credentials for the connected databases, read any data accessible through those connections, and export data. Metabase has confirmed active exploitation of this vulnerability.

Metabase is available both as Metabase Cloud, the organization’s managed SaaS offering, and as software that companies can host themselves.

According to Metabase, its Cloud consumers have already been patched and upgraded while businesses running flawed self-hosted deployments should update manually.

Metabase has recommended self-hosted customers to immediately upgrade, review API keys and administrator accounts for illegal changes, remove all active user sessions, check logs and query history for any compromise, and rotate credentials for linked databases.

Companies impacted and disclosed information

Framework, a laptop maker company has confirmed data theft after hackers breached its Metabase instance. The hackers stole customer information, such as names, login IP addresses, email addresses, company names, contacts, shipping and billing addresses. 

For Framework, stolen information of Business customers may include contacts, VAT, company names, billing email address, and EIN. 

Tally also informed its users that its Metabase analytics environment was hacked on August 3.