OpenMetadata Authentication Bypass (CVE-2024-28255)
Description
OpenMetadata versions prior to 1.2.4 contain a critical authentication bypass vulnerability in the JWT validation filter. Attackers can exploit path parameter manipulation to circumvent JWT token validation entirely, gaining unauthorized access to protected API endpoints without authentication. This bypass can be chained with other vulnerabilities, including SpEL (Spring Expression Language) injection flaws, to achieve remote code execution.
Remediation
Immediately upgrade OpenMetadata to version 1.2.4 or later, which contains patches for this authentication bypass vulnerability. Follow these steps:
1. Back up your current OpenMetadata configuration and metadata database
2. Review the official upgrade documentation at https://docs.open-metadata.org/
3. Upgrade to version 1.2.4 or the latest stable release
4. Verify that JWT authentication is functioning correctly after upgrade by testing API endpoint access
5. Review access logs for any suspicious unauthenticated access attempts prior to patching
If immediate patching is not possible, implement network-level access controls to restrict OpenMetadata access to trusted IP addresses only until the upgrade can be completed.