CVE-2024-28254 Overview
CVE-2024-28254 is a Spring Expression Language (SpEL) injection vulnerability in OpenMetadata, a unified platform for data discovery, observability, and governance. The flaw resides in the AlertUtil::validateExpression method, which evaluates user-supplied expressions using a default StandardEvaluationContext. Authenticated non-admin users can reach the /api/v1/events/subscriptions/validation/condition/<expression> endpoint and inject SpEL payloads that invoke Java classes such as java.lang.Runtime, achieving Remote Code Execution on the host operating system. The endpoint also lacks an authorization check because Authorizer.authorize() is never invoked in the affected code path. The issue is tracked as GHSL-2023-235 and classified under [CWE-78].
Critical Impact
Any authenticated OpenMetadata user can execute arbitrary system commands on the underlying server, leading to full host compromise.
Affected Products
- OpenMetadata versions prior to 1.2.4
- OpenMetadata Service component (openmetadata-service)
- Deployments exposing the events subscription validation API
Discovery Timeline
- 2024-03-15 - CVE-2024-28254 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-28254
Vulnerability Analysis
OpenMetadata exposes an alert subscription validation endpoint that accepts a condition expression from the request path. The server passes this input directly to AlertUtil.validateExpression, which compiles and evaluates the string as a Spring Expression Language expression. Because the evaluator uses the default StandardEvaluationContext, the expression is not sandboxed and can resolve arbitrary Java types.
An attacker can use T(java.lang.Runtime).getRuntime().exec(...) style SpEL payloads to spawn processes on the OpenMetadata host. The vulnerability compounds two issues: unsafe evaluation context selection and a missing authorization gate on the endpoint handler.
Root Cause
The root cause is unsafe use of Spring's SpelExpressionParser and evaluation with getValue() against StandardEvaluationContext. This context grants access to type references, constructors, static methods, and reflection. When user-controlled data flows into Expression.getValue(), the parser executes any Java operation reachable from the SpEL grammar. The affected code lives in openmetadata-service/src/main/java/org/openmetadata/service/events/subscription/AlertUtil.java.
Attack Vector
The attack requires network access to the OpenMetadata API and a valid user session, but the account does not need administrator privileges. The attacker sends a GET request to /api/v1/events/subscriptions/validation/condition/<expression> with a URL-encoded SpEL payload that references java.lang.Runtime or java.lang.ProcessBuilder. The server evaluates the expression and returns the result, executing the embedded command with the privileges of the OpenMetadata process. The vulnerability was surfaced by CodeQL's Expression language injection (Spring) query. See the GitHub Security Advisory GHSA-j86m-rrpr-g8gw for further technical detail.
Detection Methods for CVE-2024-28254
Indicators of Compromise
- Requests to /api/v1/events/subscriptions/validation/condition/ containing T(java.lang.Runtime), getRuntime, ProcessBuilder, or exec substrings
- Unexpected child processes spawned by the OpenMetadata Java process (sh, bash, cmd.exe, curl, wget)
- Outbound network connections from the OpenMetadata host to previously unseen destinations following API activity
Detection Strategies
- Alert on HTTP requests where the URL path matches the events subscription validation endpoint and the decoded path contains SpEL type-reference syntax such as T( or new java.
- Correlate authenticated non-admin user sessions with subsequent process creation events on the OpenMetadata host
- Review application logs for evaluation errors or stack traces originating from AlertUtil.validateExpression or org.springframework.expression.spel
Monitoring Recommendations
- Enable verbose access logging on the OpenMetadata API and forward logs to a centralized platform for retention and query
- Baseline the expected child process tree of the OpenMetadata JVM and alert on deviations
- Monitor for privilege changes and file writes in directories writable by the OpenMetadata service account
How to Mitigate CVE-2024-28254
Immediate Actions Required
- Upgrade OpenMetadata to version 1.2.4 or later, which addresses both the expression injection and the missing authorization check
- Rotate all OpenMetadata service credentials, database passwords, and integration tokens if the deployment was internet-exposed before patching
- Audit user accounts and remove unused or unknown non-admin users that could have exploited the endpoint
Patch Information
The OpenMetadata maintainers fixed the vulnerability in version 1.2.4. The patch restricts the expression evaluation context and enforces authorization on the affected endpoint. Consult the vendor advisory GHSA-j86m-rrpr-g8gw for release notes and upgrade guidance.
Workarounds
- No official workarounds exist per the vendor advisory; upgrading is required
- As an interim compensating control, restrict network access to the OpenMetadata API using a reverse proxy or firewall allowlist
- Block requests to /api/v1/events/subscriptions/validation/condition/ at the web application firewall until the upgrade is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
