A high-severity SQL injection vulnerability in OpenMetadata allows authenticated attackers to extract sensitive database information.

This is a SQL injection vulnerability located within the listCount function of the TestDefinitionDAO interface. The vulnerability arises from improper sanitization of the entityType parameter, which can be manipulated by an authenticated user to perform unauthorized database queries.

The ability to perform SQL injection poses a significant risk to data confidentiality and integrity. An attacker could potentially extract sensitive metadata or configuration data from the underlying database, leading to unauthorized information disclosure. Given the CVSS score of 7.1, this vulnerability represents a high risk to organizational data security, particularly in environments where OpenMetadata stores critical business intelligence or data lineage information.

Immediate Action: Since a specific patch version is currently unconfirmed, administrators should restrict access to the OpenMetadata service to trusted users only and monitor for unusual database query patterns.

Proactive Monitoring: Review database and application logs for suspicious SQL syntax, unexpected query results, or high volumes of queries originating from the listCount function.

Compensating Controls: Deploy a Web Application Firewall (WAF) with SQL injection protection rules to inspect and block malicious payloads targeting the entityType parameter.

Public Exploit Available: Yes, a published PoC exists, as evidenced by the technical write-up provided in the referenced Gist.

Given the availability of a public proof-of-concept and the potential for sensitive data exposure, users must prioritize the mitigation of this flaw. Administrators should monitor official OpenMetadata security advisories for the release of a patched version and apply it immediately upon availability. In the interim, strictly enforced access controls and WAF configurations are essential to reduce the attack surface.