Proposal: Metabase Local File Inclusion - CVE-2021-41277 (CISA KEV)

Summary

CVE-2021-41277 is an unauthenticated Local File Inclusion vulnerability in Metabase, an open-source BI and analytics platform. It affects the open-source track (v0.40.0 – v0.40.4) and the enterprise track (v1.40.0 – v1.40.4). The vulnerability is listed among the CISA's Known Exploited Vulnerabilities catalog.

Description

The /api/geojson endpoint in Metabase accepts a url query parameter to load custom GeoJSON map data. In affected versions, this parameter is passed directly to the server's internal file-fetching logic without any scheme validation or path sanitization. This allows an unauthenticated attacker to supply a file:// URI and read arbitrary files from the server filesystem, including environment variables, configuration files, and credentials in a single unauthenticated GET request.

References:

• https://nvd.nist.gov/vuln/detail/CVE-2021-41277

Testing

For the vulnerable instance, I deployed the Vulhub Docker environment (vulhub/metabase/CVE-2021-41277) running Metabase v0.40.3. The module correctly hit http://127.0.0.1:3000/api/geojson?url=file:///etc/passwd, matched root:.*:0:0 in the response body, and logged Detected.
For the patched instance, I tested against Metabase v0.40.5 and confirmed the module returns no result.

It successfully passed both tests.

Proposal

If maintainers agree, I would like to submit a PR adding:
metabase_cve_2021_41277.yaml

Start with the reported /api/geojson behavior and the vulnerable v0.40.3 and patched v0.40.5 test cases. Add the proposed metabase_cve_2021_41277.yaml module, then verify that it detects the vulnerable instance and returns no result for the patched version.