Metabase < 0.57.13 / 0.58.x < 0.58.7 / 1.x < 1.57.13 / 1.58.x < 1.58.7 Information Disclosure

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(299881);
  script_version("1.3");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/03/16");

  script_cve_id("CVE-2026-27464");

  script_name(english:"Metabase < 0.57.13 / 0.58.x < 0.58.7 / 1.x < 1.57.13 / 1.58.x < 1.58.7 Information Disclosure");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is affected by an information disclosure vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Metabase installed on the remote host is prior to 0.57.13, 0.58.x prior to 0.58.7, 1.x prior to
1.57.13, or 1.58.x prior to 1.58.7. It is, therefore, affected by an information disclosure vulnerability:

  - Authenticated users are able to retrieve sensitive information from a Metabase instance, including database
    access credentials. A low-privileged user can extract sensitive information including database credentials
    into the email body via template evaluation. (CVE-2026-27464)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported
version number.");
  # https://github.com/metabase/metabase/security/advisories/GHSA-vcj8-rcm8-gfj9
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?0343531b");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Metabase version 0.57.13, 0.58.7, 1.57.13, 1.58.7, or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-27464");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/02/19");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/02/19");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/02/24");

  script_set_attribute(attribute:"plugin_type", value:"remote");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:metabase:metabase");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"CGI abuses");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("metabase_detect.nbin");
  script_require_keys("installed_sw/Metabase");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Metabase', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '0.57.13'},
        {'min_version': '0.58.0', 'fixed_version': '0.58.7'},
        {'min_version': '1.0.0', 'fixed_version': '1.57.13'},
        {'min_version': '1.58.0', 'fixed_version': '1.58.7'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);