A critical unauthenticated SQL injection vulnerability in NCEAS Metacat allows remote attackers to fully compromise the underlying database.

The application fails to sanitize user input in the nodeID parameter of its REST API endpoints, leading to SQL injection. An unauthenticated attacker can exploit this to extract, modify, or delete sensitive data from the backend PostgreSQL database.

Successful exploitation results in total loss of confidentiality, integrity, and availability for the data managed by Metacat. Given the CVSS score of 9.8, this vulnerability poses a severe threat to data repositories, potentially exposing research metadata, access logs, and user identity information.

Immediate Action: Upgrade to Metacat version 3.4.1 or later to remediate the underlying code flaw.

Proactive Monitoring: Review application logs for anomalous database queries or unusual error messages containing SQL syntax.

Compensating Controls: If patching is not immediately feasible, disable the affected REST API endpoints by removing the servlet mappings for the CNRestServlet classes in the application web.xml file.

Public Exploit Available: Unknown

This vulnerability represents a critical security risk that requires immediate attention. Organizations should prioritize upgrading to version 3.4.1. If an immediate upgrade is not possible, the provided workaround to disable the affected API endpoints should be implemented without delay to prevent potential exploitation.