CVE-2024-28254

🗓️ 15 Mar 2024 19:55:41Reported by GitHub_MType

cve🔗 web.nvd.nist.gov👁 230 Views🌐 WEB

OpenMetadata platform allows remote code execution via SpEL expression, leading to arbitrary system command execution. Upgrade to version 1.2.4 recommended

Reporter	Title	Published	Views	Family All 17
0day.today	OpenMetadata 1.2.3 Authentication Bypass / SpEL Injection Exploit	15 Aug 202400:00	–	zdt
ATTACKERKB	CVE-2024-28255	15 Mar 202400:00	–	attackerkb
BDU FSTEC	The vulnerability of the `AlertUtil::validateExpression` method (/api/v1/events/subscriptions/validation/condition/) of the OpenMetadata platform allows a perpetrator to execute arbitrary code.	25 Apr 202400:00	–	bdu_fstec
Circl	CVE-2024-28254	15 Mar 202421:22	–	circl
CNNVD	OpenMetadata Security Vulnerabilities	15 Mar 202400:00	–	cnnvd
Cvelist	CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata	15 Mar 202419:55	–	cvelist
Metasploit	OpenMetadata authentication bypass and SpEL injection exploit chain	14 Aug 202418:52	–	metasploit
NVD	CVE-2024-28254	15 Mar 202420:15	–	nvd
OSV	CVE-2024-28254 SpEL Injection in `GET /api/v1/events/subscriptions/validation/condition/<expr>` in OpenMetadata	15 Mar 202419:55	–	osv
Packet Storm	OpenMetadata 1.2.3 Authentication Bypass / SpEL Injection	15 Aug 202400:00	–	packetstorm

NVD

Vulners

Vulnrichment

Node

open-metadata openmetadataRange<1.2.4

[
  {
    "vendor": "open-metadata",
    "product": "OpenMetadata",
    "versions": [
      {
        "version": "< 1.2.4",
        "status": "affected"
      }
    ]
  }
]

Source	Link
github	www.github.com/spring-projects/spring-framework/blob/4e2d3573189b7c0afce62bce29cd915de4077f56/spring-expression/src/main/java/org/springframework/expression/spel/standard/SpelExpression.java
github	www.github.com/open-metadata/OpenMetadata/blob/84054a85d3478e3e3795fe92daa633ec11c9d6d9/openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java
github	www.github.com/open-metadata/OpenMetadata/security/advisories/GHSA-j86m-rrpr-g8gw
codeql	www.codeql.github.com/codeql-query-help/java/java-spel-expression-injection
github	www.github.com/open-metadata/OpenMetadata/blob/84054a85d3478e3e3795fe92daa633ec11c9d6d9/openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java

Parameter	Position	Path	Description	CWE
<expression>	path	/api/v1/events/subscriptions/validation/condition/<expression>	SpEL injection in the validation/condition endpoint leading to remote code execution (RCE) via Java Runtime, with authentication bypass in chained exploit.	CWE-78

17 Jun 2026 07:21Current

9.7High risk

Vulners AI Score9.7

CVSS 3.18.8

EPSS0.45725

SSVC