Metabase 0.58.x < 0.58.24 / 0.59.x < 0.59.21 / 0.60.x < 0.60.17 / 0.61.x < 0.61.11 / 0.62.x < 0.62.9 / 0.63.x < 0.63.5 / 1.58.x < 1.58.24 / 1.59.x < 1.59.21 / 1.60.x < 1.60.17 / 1.61.x < 1.61.11 / 1.62.x < 1.62.9 / 1.63.x < 1.63.5 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(334690);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/12");

  script_cve_id("CVE-2026-72898", "CVE-2026-72899", "CVE-2026-72900");
  script_cwe_id(89, 862);

  script_name(english:"Metabase 0.58.x < 0.58.24 / 0.59.x < 0.59.21 / 0.60.x < 0.60.17 / 0.61.x < 0.61.11 / 0.62.x < 0.62.9 / 0.63.x < 0.63.5 / 1.58.x < 1.58.24 / 1.59.x < 1.59.21 / 1.60.x < 1.60.17 / 1.61.x < 1.61.11 / 1.62.x < 1.62.9 / 1.63.x < 1.63.5 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"The version of Metabase installed on the remote host is 0.58.x prior to 0.58.24, 0.59.x prior to 0.59.21, 0.60.x
prior to 0.60.17, 0.61.x prior to 0.61.11, 0.62.x prior to 0.62.9, 0.63.x prior to 0.63.5, 1.58.x prior to 1.58.24,
1.59.x prior to 1.59.21, 1.60.x prior to 1.60.17, 1.61.x prior to 1.61.11, 1.62.x prior to 1.62.9, or 1.63.x prior
to 1.63.5. It is, therefore, affected by multiple vulnerabilities:

  - A remote, unauthenticated attacker can inject arbitrary SQL via the '/reset_password' database endpoint and gain
    administrator access to the connected Metabase instance. (CVE-2026-72898)

  - An unauthenticated attacker can inject arbitrary SQL via a publicly shared card or dashboard that exposes a
    field-filter (dimension) parameter. (CVE-2026-72899)

  - An authenticated, low-privileged attacker can read the entire Metabase application database. (CVE-2026-72900)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported
version number.");
  # https://github.com/metabase/metabase/security/advisories/GHSA-vwf4-m7j8-wcjf
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?20002870");
  script_set_attribute(attribute:"see_also", value:"https://www.metabase.com/blog/security-update");
  # https://github.com/metabase/metabase/security/advisories/GHSA-r8h2-qpfx-mx59
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?b0893994");
  # https://github.com/metabase/metabase/security/advisories/GHSA-8hmm-hrhg-ppqp
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?49b1871d");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Metabase version 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, 0.63.5, 1.58.24, 1.59.21, 1.60.17,
1.61.11, 1.62.9, 1.63.5, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-72898");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/06");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/06");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/12");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:metabase:metabase");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("metabase_detect.nbin");
  script_require_keys("installed_sw/Metabase");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Metabase', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '0.58.0', 'fixed_version': '0.58.24'},
        {'min_version': '0.59.0', 'fixed_version': '0.59.21'},
        {'min_version': '0.60.0', 'fixed_version': '0.60.17'},
        {'min_version': '0.61.0', 'fixed_version': '0.61.11'},
        {'min_version': '0.62.0', 'fixed_version': '0.62.9'},
        {'min_version': '0.63.0', 'fixed_version': '0.63.5'},
        {'min_version': '1.58.0', 'fixed_version': '1.58.24'},
        {'min_version': '1.59.0', 'fixed_version': '1.59.21'},
        {'min_version': '1.60.0', 'fixed_version': '1.60.17'},
        {'min_version': '1.61.0', 'fixed_version': '1.61.11'},
        {'min_version': '1.62.0', 'fixed_version': '1.62.9'},
        {'min_version': '1.63.0', 'fixed_version': '1.63.5'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE, flags:{"sqli": "TRUE"});
vdf::handle_check_and_report_errors(vdf_result:result);