Framework Laptop Breach Exploits Metabase 0-Day

Framework Discloses Breach via Metabase 0-Day

Framework Computer, known for its modular laptops, disclosed a data breach on January 23, 2025. Attackers exploited a known Metabase vulnerability (CVE-2023-38646) to access customer email addresses. The breach targeted a publicly accessible Metabase instance used for internal analytics. Framework's security team detected the intrusion on January 22 and immediately took the instance offline.

The Vulnerability

CVE-2023-38646 is a pre-auth remote code execution (RCE) flaw in Metabase. It exists in versions before 0.46.6.1, 1.46.6.1, and 1.47.5. Attackers can exploit it via a crafted request to the /api/geojson endpoint, using an attacker-controlled token parameter to bypass authentication and execute arbitrary commands. The flaw was patched in June 2023, but Framework had not applied the patch.

Attack Details

Framework's investigation revealed that the attackers used the Metabase vulnerability to gain initial access. They then extracted a database containing customer email addresses. The breach is limited to email addresses; no passwords, financial data, or other personal information was compromised. Framework confirmed that the affected Metabase instance was isolated from other internal systems, limiting the blast radius.

Framework's Response

Framework has since applied the patch to the Metabase instance and rotated all relevant credentials. They are notifying affected customers directly. In their community post, they advise users to be wary of phishing emails, as the stolen email addresses could be used for targeted attacks. They also recommend enabling two-factor authentication (2FA) on all accounts.

Broader Implications

This incident underscores a common problem: unpatched software in critical infrastructure. Metabase is a popular open-source business intelligence tool, widely used for dashboards and analytics. Many organizations expose Metabase instances to the internet without proper security hardening. The vulnerability is over a year old, yet Framework's case shows that many still haven't patched.

What You Should Do

If you use Metabase, check your version immediately. Upgrade to the latest version (>= 0.46.6.1, >= 1.46.6.1, or >= 1.47.5). If you can't upgrade, restrict network access to the Metabase instance. At minimum, ensure it's not exposed to the public internet. Use a firewall or VPN to limit access.

Also, audit your other internet-facing services for known vulnerabilities. Use tools like Nmap or Nessus to scan for exposed services. Implement a patch management process that prioritizes critical vulnerabilities.

Framework's breach is a reminder that security is an ongoing process. Patch promptly. Monitor logs. Assume breach. The cost of a data breach far outweighs the effort of staying current.

Technical Details

The Metabase vulnerability is a pre-auth RCE that works by sending a POST request to /api/geojson with a JSON body containing a token value. The token is used to retrieve a cached GeoJSON file, but if the token is invalid, Metabase will attempt to load the file from an arbitrary URL, leading to SSRF. By chaining SSRF with a crafted payload, attackers can achieve RCE. The fix was to validate the token and ensure it matches a known value.

Framework's incident response team acted within hours of detection. They have since published a detailed postmortem on their community forum. This level of transparency is commendable and sets a standard for other companies.

Conclusion

This is a wake-up call for developers and system administrators. Even a well-known vulnerability can be exploited if left unpatched. The attack surface is broader than you think. Review your infrastructure, prioritize patches, and assume that your systems are targeted.

Now, go update your Metabase instance. If you're not sure, check your version with metabase --version or look at the admin panel. If you're affected, follow Framework's lead: disclose, patch, and communicate.