CVE-2024-28847: OpenMetadata SpEL Injection RCE Vulnerability

CVE-2024-28847 Overview

CVE-2024-28847 is a Spring Expression Language (SpEL) injection vulnerability in OpenMetadata, a unified platform for data discovery, observability, and governance. The flaw resides in AlertUtil::validateExpression, which is invoked through EventSubscriptionRepository.prepare() before authorization checks execute. An authenticated attacker can send a crafted PUT request to /api/v1/events/subscriptions to trigger evaluation of attacker-controlled SpEL expressions on the server. Successful exploitation results in remote code execution against the OpenMetadata service. The issue is tracked as GHSL-2023-251 and was discovered using CodeQL's expression language injection query. OpenMetadata addressed the flaw in version 1.2.4.

Critical Impact
Authenticated attackers can achieve remote code execution on OpenMetadata servers by injecting SpEL expressions into event subscription requests, compromising confidentiality, integrity, and availability of the metadata platform.

Affected Products

OpenMetadata versions prior to 1.2.4
open-metadata:openmetadata service component
Deployments exposing the /api/v1/events/subscriptions API endpoint

Discovery Timeline

2024-03-15 - CVE-2024-28847 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28847

Vulnerability Analysis

The vulnerability is a code injection flaw classified under [CWE-94]. OpenMetadata evaluates Spring Expression Language (SpEL) expressions supplied within event subscription payloads without adequate sandboxing. When a client submits a subscription definition, the server calls EntityResource.createOrUpdate(), which delegates to EntityRepository.prepareInternal(). That method invokes EventSubscriptionRepository.prepare(), which reaches AlertUtil::validateExpression and evaluates the attacker-supplied expression.

The evaluation runs before authorizer.authorize() executes. Any authenticated user who can reach the endpoint can therefore trigger expression evaluation regardless of their role. SpEL evaluation exposes reflective access to Java runtime classes, enabling arbitrary process execution through classes such as java.lang.Runtime.

Root Cause

The root cause is the use of an unrestricted SpEL evaluator against user-controlled input combined with an ordering flaw in the request pipeline. prepareInternal() performs input preparation, including expression validation, before authorization occurs. Because SpEL evaluation is inherently a code execution primitive, validating untrusted expressions in this manner directly translates a data-plane input into a control-plane operation. This mirrors the pattern previously identified in GHSL-2023-250.

Attack Vector

An attacker with valid credentials sends a PUT request to /api/v1/events/subscriptions. The request body contains an event subscription payload whose condition or filter field embeds a malicious SpEL expression. Handling passes through EventSubscriptionResource.createOrUpdateEventSubscription() into the repository layer, where the expression is evaluated. The attacker executes commands under the OpenMetadata service account, enabling lateral movement, credential theft, and access to metadata backing stores.

The vulnerability requires network reachability to the OpenMetadata API and low-privilege authenticated access. No user interaction is needed. Refer to the OpenMetadata Security Advisory GHSA-8p5r-6mvv-2435 and the CodeQL Java SpEL Injection Guide for technical detail.

Detection Methods for CVE-2024-28847

Indicators of Compromise

PUT or POST requests to /api/v1/events/subscriptions containing SpEL syntax such as T(java.lang.Runtime), #{, or new ProcessBuilder
OpenMetadata JVM processes spawning child processes such as sh, bash, cmd.exe, curl, or wget
Outbound network connections initiated by the OpenMetadata Java process to unfamiliar hosts
New or modified event subscription objects with unusual condition or filter fields

Detection Strategies

Inspect application access logs for requests to /api/v1/events/subscriptions and flag payloads containing SpEL metacharacters or Java class references
Monitor the OpenMetadata service for unexpected process lineage using endpoint telemetry
Correlate authentication events with subscription-modification API calls to identify low-privilege accounts abusing the endpoint

Monitoring Recommendations

Forward OpenMetadata application logs and host process telemetry to a centralized analytics platform for behavioral analysis
Alert on any child process created by the OpenMetadata JVM outside expected worker processes
Baseline normal event subscription creation frequency and alert on volume spikes or off-hours activity

How to Mitigate CVE-2024-28847

Immediate Actions Required

Upgrade OpenMetadata to version 1.2.4 or later, which contains the vendor fix
Rotate credentials, API tokens, and service account secrets accessible to the OpenMetadata deployment if compromise is suspected
Restrict network access to the OpenMetadata API to trusted management networks and identity providers
Audit existing event subscriptions for suspicious condition or filter expressions and remove unauthorized entries

Patch Information

The vendor released the fix in OpenMetadata 1.2.4. Details are documented in the OpenMetadata Security Advisory GHSA-8p5r-6mvv-2435. Users on earlier 1.x branches should upgrade directly to 1.2.4 or a later maintained release. The advisory notes that no workarounds exist.

Workarounds

No vendor-supplied workarounds exist; upgrading is required
As a compensating control, place the OpenMetadata API behind an authenticated reverse proxy that filters SpEL-like syntax from request bodies
Reduce the number of accounts holding write access to event subscription endpoints until patching is complete

bash

# Verify OpenMetadata version after upgrade
curl -sS -H "Authorization: Bearer $TOKEN" \
  https://openmetadata.example.com/api/v1/system/version