CVE-2021-41277: Metabase Path Traversal Vulnerability

CVE-2021-41277 Overview

CVE-2021-41277 is a Local File Inclusion (LFI) vulnerability affecting Metabase, an open source data analytics platform. The vulnerability exists in the custom GeoJSON map feature (admin->settings->maps->custom maps->add a map) where URLs were not validated prior to being loaded. This allows attackers to perform local file inclusion attacks, potentially exposing sensitive files including environment variables from the server.

Critical Impact

This vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. Attackers can leverage this flaw to read sensitive local files and environment variables from vulnerable Metabase instances without authentication.

Affected Products

• Metabase Open Source versions 0.40.0 through 0.40.4
• Metabase Enterprise versions 1.40.0 through 1.40.4
• All prior versions containing the custom GeoJSON map feature

Discovery Timeline

• 2021-11-17 - CVE-2021-41277 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2021-41277

Vulnerability Analysis

The vulnerability resides in how Metabase handles URL input for the custom GeoJSON map feature. When administrators or users with sufficient privileges add a custom map, the application accepts a URL parameter specifying the location of the GeoJSON data. Due to insufficient input validation, the application fails to restrict this URL to legitimate remote resources, allowing attackers to specify local file paths using file protocol handlers or path traversal sequences.

This Path Traversal (CWE-22) and Information Exposure (CWE-200) vulnerability enables attackers to read arbitrary files from the server filesystem that the Metabase process has access to. The impact is particularly severe because environment variables often contain sensitive configuration data, database credentials, API keys, and other secrets that could facilitate further attacks.

Root Cause

The root cause of this vulnerability is the lack of URL validation in the custom GeoJSON map functionality. The application accepts user-supplied URLs without verifying that they point to legitimate external HTTP/HTTPS resources. This missing validation allows attackers to supply file:// protocol URLs or relative path traversal sequences that the server then processes, inadvertently reading and returning local file contents.

Attack Vector

The attack exploits the custom GeoJSON map feature accessible through Metabase's settings interface. An attacker can craft a malicious request to the API endpoint responsible for fetching GeoJSON data, substituting the expected remote URL with a path pointing to local files. When the server processes this request, it reads the specified local file and returns its contents to the attacker.

The attack can be executed remotely over the network without requiring any user interaction. While the feature is typically an admin function, the vulnerability can potentially be exploited by any user who can access the relevant API endpoint, depending on the Metabase configuration and access controls in place.

For technical details on the exploitation mechanism, refer to the GitHub Security Advisory which contains comprehensive information about the attack vector.

Detection Methods for CVE-2021-41277

Indicators of Compromise

• Unusual requests to GeoJSON-related API endpoints containing file path patterns or traversal sequences (e.g., ../, file://)
• HTTP requests to Metabase endpoints with parameters referencing local system paths like /etc/passwd or environment file locations
• Access logs showing requests to custom map API endpoints from unexpected sources or at unusual times
• Evidence of sensitive file access in server logs that correlate with Metabase API activity

Detection Strategies

• Implement WAF rules to detect and block requests containing path traversal patterns (../, ..\\) or file protocol handlers (file://) in GeoJSON URL parameters
• Monitor Metabase application logs for failed or unusual map configuration requests
• Deploy network-based intrusion detection signatures that identify LFI attack patterns targeting Metabase endpoints
• Conduct regular log analysis focusing on the custom maps API endpoints for anomalous access patterns

Monitoring Recommendations

• Enable verbose logging for Metabase API requests, particularly those related to settings and map configurations
• Set up alerts for any requests to GeoJSON endpoints that contain suspicious path patterns
• Monitor outbound connections from the Metabase server to detect any data exfiltration attempts
• Review CISA's Known Exploited Vulnerabilities Catalog for updated threat intelligence

How to Mitigate CVE-2021-41277

Immediate Actions Required

• Upgrade Metabase immediately to version 0.40.5 (Open Source) or 1.40.5 (Enterprise) or any subsequent release
• Audit Metabase access logs for any evidence of exploitation attempts prior to patching
• Review and rotate any credentials or secrets that may have been exposed through environment variables
• Restrict access to Metabase administrative functions to trusted users only

Patch Information

Metabase has released security patches in maintenance releases 0.40.5 and 1.40.5 that address this vulnerability. The fix is included in all subsequent releases. Organizations should upgrade to the latest available version to ensure they receive this and any additional security fixes. The specific commit addressing this issue can be reviewed in the GitHub Commit.

Workarounds

• If immediate upgrade is not possible, implement validation rules in your reverse proxy, load balancer, or WAF to filter requests before they reach the Metabase application
• Block requests containing path traversal sequences (../) or file protocol handlers (file://) in URL parameters
• Restrict network access to Metabase administrative interfaces to trusted IP ranges only
• Consider temporarily disabling the custom GeoJSON map feature if it is not required for operations

# Example nginx configuration to block LFI attempts
location /api/geojson {
    # Block requests with path traversal or file protocol
    if ($request_uri ~* "(\.\.\/|file:\/\/)") {
        return 403;
    }
    proxy_pass http://metabase_backend;
}