An authenticated SQL injection vulnerability in OpenMetadata versions 1.4.4 and earlier permits unauthorized database information extraction, posing a significant risk to data confidentiality.

The application is vulnerable to SQL injection via the testPlatform parameter within the listCount function of the TestDefinitionDAO interface. This flaw requires the attacker to have low-level authenticated access to the platform to manipulate backend database queries.

Successful exploitation allows an authenticated user to perform unauthorized queries against the underlying database, potentially leading to the compromise of sensitive metadata and system configuration details. With a CVSS score of 7.1, this vulnerability represents a high risk to organizational data integrity and confidentiality. Unauthorized access to the database layer can be leveraged to escalate privileges or exfiltrate critical business intelligence managed by the platform.

Immediate Action: Review the official OpenMetadata security advisories for the release of a patched version and apply updates immediately upon availability.

Proactive Monitoring: Monitor database access logs and application audit trails for unusual query patterns or unexpected input strings originating from the testPlatform parameter.

Compensating Controls: Implement a Web Application Firewall (WAF) with rules configured to detect and block SQL injection patterns targeting the application endpoints.

Public Exploit Available: Yes, a published proof-of-concept exists and is attributed to the security researcher's write-up provided in the references.

The identified SQL injection flaw presents a clear and actionable risk to OpenMetadata deployments. Administrators should prioritize identifying all instances of the affected software and prepare for immediate patching once the vendor releases a fix. Until a patch is deployed, ensure that access controls are strictly enforced to limit the potential pool of attackers who could reach the vulnerable interface.