CVE-2024-28848: OpenMetadata SpEL Injection RCE Vulnerability

CVE-2024-28848 Overview

CVE-2024-28848 is a Spring Expression Language (SpEL) injection vulnerability in OpenMetadata, a unified platform for data discovery, observability, and governance. The CompiledRule::validateExpression method evaluates user-supplied SpEL expressions using a StandardEvaluationContext, which grants access to Java classes such as java.lang.Runtime. The /api/v1/policies/validation/condition/<expression> endpoint passes attacker-controlled input directly into this evaluator. Compounding the issue, the endpoint never invokes Authorizer.authorize(), allowing any authenticated non-admin user to trigger the code path. The flaw is tracked as GHSL-2023-236 and was identified using CodeQL's Spring expression language injection query. Exploitation leads to arbitrary operating system command execution on the OpenMetadata host.

Critical Impact
Authenticated non-admin users can execute arbitrary operating system commands on the OpenMetadata server, resulting in full compromise of the underlying host.

Affected Products

OpenMetadata versions prior to 1.2.4
open-metadata:openmetadata server component
Deployments exposing the /api/v1/policies/validation/condition/ endpoint

Discovery Timeline

2024-03-15 - CVE-2024-28848 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-28848

Vulnerability Analysis

The vulnerability is an expression language injection classified under CWE-94 (Improper Control of Generation of Code). OpenMetadata uses SpEL to evaluate policy conditions defined by administrators. The CompiledRule::validateExpression method constructs a StandardEvaluationContext, which by default permits reflection and access to arbitrary Java types. When attacker-controlled input reaches this evaluator, expressions such as T(java.lang.Runtime).getRuntime().exec(...) resolve and execute at runtime. The result is command execution under the privileges of the OpenMetadata process.

Root Cause

Two design defects combine to produce the vulnerability. First, CompiledRule::validateExpression uses StandardEvaluationContext instead of the restrictive SimpleEvaluationContext, exposing the full Java type system to SpEL evaluation. Second, the handler for /api/v1/policies/validation/condition/<expression> does not call Authorizer.authorize(), so authorization is not enforced before the expression is parsed and evaluated.

Attack Vector

An attacker authenticates with any low-privilege OpenMetadata account and issues an HTTP request to the policy validation endpoint with a SpEL payload embedded in the URL path. The server compiles and evaluates the expression, invoking Runtime.exec or equivalent constructs to run arbitrary shell commands. See the GitHub Security Advisory GHSA-5xv3-fm7g-865r and the CodeQL Java SpEL Injection Guide for technical details.

No verified proof-of-concept code is included here. Refer to the vendor advisory and the vulnerable code paths at CompiledRule.java line 51 and line 57.

Detection Methods for CVE-2024-28848

Indicators of Compromise

HTTP requests to /api/v1/policies/validation/condition/ containing SpEL syntax such as T(java.lang.Runtime), getRuntime(), exec(, or new ProcessBuilder.
Unexpected child processes spawned by the OpenMetadata Java process, including sh, bash, curl, wget, or python.
Outbound network connections from the OpenMetadata host to unfamiliar IP addresses shortly after policy validation requests.

Detection Strategies

Inspect application access logs for requests to the policy validation endpoint originating from non-administrative accounts.
Correlate web request logs with process-creation telemetry to link inbound API calls to shell execution on the host.
Deploy web application firewall rules to flag URL-encoded SpEL primitives such as T%28, %23this, and getRuntime.

Monitoring Recommendations

Alert on any process descendant of the OpenMetadata JVM that is not a legitimate helper binary.
Baseline outbound traffic from OpenMetadata servers and alert on new destinations or protocols.
Ingest OpenMetadata audit and application logs into a centralized platform to retain forensic evidence of authentication and API activity.

How to Mitigate CVE-2024-28848

Immediate Actions Required

Upgrade OpenMetadata to version 1.2.4 or later, which resolves the vulnerability.
Rotate credentials for all OpenMetadata users and any downstream service accounts stored in the platform, assuming potential compromise.
Restrict network access to the OpenMetadata API to trusted management networks until patching is complete.
Review audit logs for prior requests to /api/v1/policies/validation/condition/ and investigate any anomalous entries.

Patch Information

The OpenMetadata maintainers released a fix in version 1.2.4. The patch replaces the permissive evaluation context and enforces authorization on the affected endpoint. Details are published in the GitHub Security Advisory GHSA-5xv3-fm7g-865r.

Workarounds

The vendor states there are no known workarounds; upgrading to 1.2.4 or later is required.
As a temporary compensating control, block or reverse-proxy filter requests to /api/v1/policies/validation/condition/ until patching completes.
Enforce network segmentation so the OpenMetadata server cannot initiate arbitrary outbound connections.

bash

# Example reverse-proxy rule (nginx) to block the vulnerable endpoint pre-patch
location ~* ^/api/v1/policies/validation/condition/ {
    return 403;
}