CVE-2021-41277
Metabase GeoJSON API Local File Inclusion Vulnerability
Description
CVE-2021-41277 is a critical local file inclusion vulnerability in Metabase, an open-source data analytics and business intelligence platform. The flaw exists in the custom GeoJSON map functionality and affects Metabase versions 0.40.0 through 0.40.4 and 1.40.0 through 1.40.4. With a maximum CVSS v3.1 base score of 10.0, an unauthenticated attacker with network access can exploit insufficient URL validation to read local files from the server, including environment variables that may contain database credentials, API keys, and other secrets. CISA has added CVE-2021-41277 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 3, 2024, and its ransomware association is classified as Unknown. The EPSS score of 94.35% at the 100th percentile places it among the most actively exploited vulnerabilities tracked globally.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:LOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| metabase | metabase | 0.40.0; 0.40.1; 0.40.2; 0.40.3; 0.40.4; 1.40.0; 1.40.1; 1.40.2; 1.40.3; 1.40.4 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
- https://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0(Patch)
- https://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr(Mitigation, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2021-41277(US Government Resource)
Weakness Type
Server-Side Request Forgery (SSRF) / Local File Inclusion via GeoJSON Map Feature
CVE-2021-41277 exploits a local file inclusion vulnerability in Metabase's custom GeoJSON map feature. The application's map settings functionality (accessible through admin -> settings -> maps -> custom maps -> add a map) accepts URLs for GeoJSON data sources but fails to validate these URLs before loading them. An attacker can supply file:// protocol URLs or other internal resource references instead of legitimate HTTP/HTTPS GeoJSON URLs, causing the server to read and return the contents of local files. This is a form of Server-Side Request Forgery where the attacker manipulates the server into accessing unintended resources. Learn more about CWE-918: Server-Side Request Forgery (SSRF)
Improper Limitation of a Pathname to a Restricted Directory
The vulnerability also involves path traversal characteristics, as the unvalidated URL input allows access to files outside the intended GeoJSON data directory. The lack of input sanitization means the attacker can reference any file on the server filesystem that is readable by the Metabase process, including sensitive configuration files and environment variable stores. Learn more about CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Impact Analysis
The impact of CVE-2021-41277 is catastrophic, achieving the maximum possible CVSS base score of 10.0 with a changed scope that extends the blast radius beyond the Metabase application itself. Confidentiality is fully compromised (C:H) because the local file inclusion allows an attacker to read any file accessible to the Metabase server process. This critically includes environment variables, which in modern deployment practices typically contain database connection strings, API keys, SMTP credentials, encryption secrets, and third-party service tokens. Reading /proc/self/environ on Linux systems can expose the complete runtime environment of the Metabase process.
Integrity faces maximum impact (I:H) with the changed scope because the credentials obtained through file reading can be used to compromise connected systems. Database credentials can grant write access to the analytics database and potentially production data sources. API keys can be used to impersonate the Metabase application to external services. The changed scope (S:C) reflects that the vulnerability in Metabase directly enables compromise of external systems that trust the stolen credentials.
Availability is impacted at a low level (A:L) reflecting potential disruption to the Metabase service itself. However, the practical availability impact can be much higher when considering the cascading effects of credential compromise on connected systems. The attack profile is maximally dangerous: network-accessible (AV:N), low complexity (AC:L), no authentication required (PR:N), and no user interaction needed (UI:N). The EPSS score of 94.35% at the 100th percentile confirms this vulnerability is being exploited more actively than virtually every other tracked vulnerability, with automated scanning tools widely targeting exposed Metabase instances.
Exploit Maturity
CVE-2021-41277 has reached the absolute maximum exploit maturity with publicly available exploits, confirmed mass exploitation, and inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of December 3, 2024. The EPSS score of 94.35% at the 100th percentile places it at the peak of global exploitation activity.
The vulnerability was reported through GitHub's security advisory process, with the original advisory at GHSA-w73v-6p7p-fpfr providing detailed technical information. The Metabase team released a patch commit that addresses the URL validation issue. Because the vulnerability requires no authentication and can be exploited with a single HTTP request, automated exploitation tools and scripts have proliferated widely. The simplicity of exploitation combined with the high value of the exposed data (environment variables containing credentials) makes this vulnerability an extremely attractive target for both opportunistic and targeted attackers. The ransomware association remains Unknown, but the credential exposure capability makes it a potent initial access vector for any type of follow-on attack.
Remediation
-
Upgrade Metabase to a patched version immediately. Update to Metabase 0.40.5 or 1.40.5, or any subsequent release that includes the fix. The security advisory confirms these versions address the URL validation vulnerability. If you are running a version older than 0.40.x, upgrade to the latest stable release to benefit from all security fixes.
-
Rotate all credentials exposed through environment variables. If a Metabase instance was running an affected version and was accessible from untrusted networks, assume that all environment variables have been read by attackers. Rotate database passwords, API keys, SMTP credentials, encryption secrets, and any other sensitive values that were stored in environment variables or server-accessible configuration files.
-
Restrict network access to Metabase instances. Ensure Metabase is not directly exposed to the internet without authentication and access controls. Place Metabase behind a reverse proxy with authentication, deploy it within a private network segment, and use VPN or zero-trust network access for remote users. The admin settings pages, in particular, should never be accessible to unauthenticated users from untrusted networks.
-
Audit Metabase access logs for exploitation indicators. Review web server and application logs for requests targeting the GeoJSON map endpoints that contain file:// URLs, /proc/ paths, or other local file references. Look for requests to map-related API endpoints with unusual URL parameters that do not point to legitimate GeoJSON data sources.
-
Migrate sensitive configuration to secure secret management. Move credentials and secrets out of environment variables and into a dedicated secret management system (such as HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault). While environment variables are a common configuration method, this vulnerability demonstrates the risk of storing secrets in locations that can be read through local file inclusion attacks.
Technical Details
CVE-2021-41277 carries a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:L, resulting in the maximum possible base score of 10.0. The vector represents the most dangerous possible attack configuration: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and with a changed scope (S:C) that extends the impact beyond the Metabase application to connected systems.
The vulnerability exists in Metabase's custom GeoJSON map feature, which allows administrators to configure custom map overlays by providing URLs to GeoJSON data files. The application fetches the specified URL and processes the response as GeoJSON data for map rendering. The critical flaw is that the URL validation was completely absent, allowing an attacker to specify arbitrary URL schemes including file:// to read local files from the server filesystem.
The attack is executed by sending a request to the Metabase API endpoint responsible for loading custom GeoJSON map data, supplying a file:// URL pointing to a sensitive local file instead of a legitimate HTTP/HTTPS GeoJSON resource. For example, specifying file:///proc/self/environ on Linux systems returns the complete set of environment variables for the Metabase process, which in typical deployments includes database credentials (MB_DB_PASS, MB_DB_USER), encryption keys (MB_ENCRYPTION_SECRET_KEY), and other sensitive configuration values. The changed scope (S:C) in the CVSS vector reflects that these exposed credentials grant access to systems beyond Metabase itself, such as databases, email servers, and third-party APIs. Affected versions include Metabase 0.40.0 through 0.40.4 and the enterprise edition 1.40.0 through 1.40.4. The fix was released in versions 0.40.5 and 1.40.5.
Frequently Asked Questions
What is CVE-2021-41277?
CVE-2021-41277 is a critical local file inclusion vulnerability in Metabase, an open-source data analytics platform. It has the maximum CVSS score of 10.0 and allows an unauthenticated attacker to read local files from the Metabase server, including environment variables containing database credentials and API keys, through the custom GeoJSON map feature.
Which versions of Metabase are affected by CVE-2021-41277?
The vulnerability affects Metabase versions 0.40.0 through 0.40.4 and the enterprise edition versions 1.40.0 through 1.40.4. The fix was released in versions 0.40.5 and 1.40.5. Organizations should upgrade to the latest stable release to benefit from all security patches.
Can CVE-2021-41277 be exploited without authentication?
Yes. The vulnerability requires no authentication, no user interaction, and no special privileges. Any attacker with network access to a vulnerable Metabase instance can exploit this flaw by sending a single HTTP request. This makes internet-exposed Metabase instances extremely vulnerable to automated scanning and mass exploitation.
What data can an attacker access through CVE-2021-41277?
An attacker can read any file on the server filesystem that is accessible to the Metabase process. The most critical target is typically the process environment variables (via /proc/self/environ on Linux), which often contain database credentials, API keys, encryption secrets, and SMTP passwords. Configuration files, application source code, and other server-side files are also at risk.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.