Tell HN: Upgrade your Metabase installation

[hannofcart]

One of the better decisions we took at my firm was to not allow direct access to any production DB to analytics visualization tools like Metabase and Redash.

Always write your analytics data to a separate DB in a periodically run job. Only store aggregated anonymized data in the analytics DB you expose to internal stakeholders via tools like Metabase.

[jimmytucson]

Also your production database is optimized for different workloads than your analytics database.

Usually production is used for fetching and updating a small number of records at a time (think updating a shopping cart), and has strict latency requirements whereas analytics involves reading a large amount of data in columns (think count group by one or two columns), and can be done in batches where the results can get a more and more stale until the next batch runs.

[namaria]

That's a great idea and it articulates something I have thought about the whole "use boring tech" things (which I support). It doesn't preclude letting people use the shiny new thing. You can always let them plug it in and use it. But the core of the system should be as simple as possible and based on thoroughly understood tech (from the point of view of the team in question/accessible labor market).

[nneonneo]

Worth pointing out that we recently discovered an RCE in RestrictedPython that affects Redash: https://github.com/zopefoundation/RestrictedPython/security/...

This should further emphasize the need to isolate these tools and ensure they are only accessible to people who need them.

[98codes]

Exactly right -- we do all of that, and even then tightly control and audit who has access to the anonymized, aggregated, read-only data cube.

[MattJ100]

What kind of tooling do you/people use for that? Or just custom scripts?

[lecha]

How many of you have received this notice via an official security advisory channel you're monitoring/acting on? If so, which advisory service do you use and how you configure it? Learning about HN is useful, but far from a reliable solution.

[swe_dima]

I am subsribed to their Github releases and when I saw a release for every old version I knew what's up :-)

[Mandatum]

Saw it on HN.

[not_your_vase]

It is definitely not announced on Full Disclosure nor on oss-security mailing lists.

[xctr94]

I got an email directly from Metabase.

[exabrial]

I think it's important to review the term "Zero Trust" because so many companies are getting it wrong.

Zero Trust does not mean: "No mor VPNs and private IP network ranges, everything is public. ::elitist hipster noises::"

Zero Trust simply means: "Just _because_ you're on a private network [or coming from a known ip], doesn't mean you're authenticated."

You should have every single one of your internal network services (like Metabase) behind a VPN like Wireguard or numerous other options. The sole purpose of this is to reduce your firewall log noise to a manageable level that can be reviewed by hand if necessary.

Obviously this isn't perfect security, but that's the _entire_ point: every security researcher says security should be an onion, not a glass sphere; many layers of independent security.

[kevincox]

This is why I try to put everything behind NGINX with basic auth. Unfortunately not everything works well that way but in this case I suspect that this is made unexploitable by anyone without the password.

[tedeh]

Ha, I was just about to go in here and say the same thing.

"Fortunately" some "white hat" hacker contacted us last year about another Metabase exploit. I gave him a 30 USD tip and ended up doing exactly what you are suggesting.

Now I'm glad that means I don't need to interrupt my vacation to fix this thing right now.

[vdfs]

Hmm, I was thinking that's a standard thing, atleast in HN crowd. basic setup Cloudflare -> Nginx -> Docker -> 3rd Party app, all on a dedicated vm

[tlrobinson]

You can also setup some reverse proxies to auth with SSO like Google. I use Traefik + https://github.com/thomseddon/traefik-forward-auth for personal projects, even on my local network.

[square_usual]

I like NGINX, but I prefer how simple it is to set up Caddy with basic auth. Caddy is already simpler to configure (and has automatic SSL via Let's Encrypt), but it's so simple to get its basic directive working compared to NGINX that I do it by default now.

[lomereiter]

Better yet, oauth2-proxy in case of an organization: only admins need to know the secrets, every user simply uses SSO to get access.

[nullcipher]

or vpn

[riadsila]

For more context: https://www.metabase.com/blog/security-advisory

[vxNsr]

They say they’ll be releasing the patch publicly, but isn’t this OSS, can’t anyone just do a diff and with a little “elbow grease” find the patch?

[thomasfromcdnjs]

It would be nice to know if this vulnerability affects people who never made their Metabase installations publicly accessible.

Aka if I am running Metabase locally.

[Mandatum]

It’ll be an RCE. If you are network isolated or have a proxy in front of it, you can take the weekend off.

[MuffinFlavored]

How would an attacker exploit that?

[not_your_vase]

Emergency deployment late Friday afternoon (by EU time, at least), the best way to end a week :)

[kmitz]

Thanks for the heads up ! Without your message I'd probably have found out in a couple months :)

[smithcoin]

If I have my metabase installation protected behind oauth with G suite am I protected from these kinds of vectors?

[Dachande663]

Perhaps a naive question, but if running metabase within a docker container, what permissions would this RCE have? AFAIK the container has network access and access to the mounted volumes and that's it right?

[JJJollyjim]

Presumably the metabase instance also has credentials to access some databases, some of which may be have enough privileges to also get RCE on the database machines (as well as messing with the data they hold).

[hiatus]

The container has access to whatever database you connect metabase to for BI. If the db connection credentials are available to the container, it's possible a malicious actor could access your prod db.

[throwaway6734]

It depends on how the container is being run and if it has root Access

[formerly_proven]

> Extremely severe. An unauthenticated attacker can run arbitrary commands with the same privileges as the Metabase server on the server you are running Metabase on.

Java deserialization strikes another one down, I assume?

[theanonymousone]

Will it still be (as) dangerous if Metabase is running inside a container?

[Mandatum]

To all the data inside of it? Sure.

To all of the auth tokens and user creds? Why not.

[jacob_rezi]

What would happen if a software's database was completely accessible via an open api end point?

[exabrial]

thank you!