# Critical Metabase Zero-Day Exploited in Data Theft Attacks **Metabase**, a popular open-source business intelligence platform, has confirmed that a critical SQL injection vulnerability (**CVE-2024-XXXXX**, pending assignment) was actively exploited in zero-day attacks. The attacks specifically targeted customer instances, resulting in data theft, with notable impacts on companies like **Framework** and **Tally**. ## Unauthenticated SQL Injection Flaw On Thursday, **Metabase** disclosed that its **Metabase Cloud SaaS** platform was compromised through a previously unknown vulnerability affecting versions 1.58 and above. Self-hosted installations are also vulnerable. "We recently identified that Metabase Cloud was attacked by someone utilizing an unknown ("0-day") security vulnerability in versions 1.58 and above," **Metabase** CEO **Sameer Al-Sakran** warned in a blog post. The vulnerability is an unauthenticated SQL injection flaw that grants remote attackers administrator access to a customer's instance. From there, attackers could alter application configurations, steal stored credentials for connected databases, read accessible data, and export information. **Metabase** has confirmed active exploitation.  ## Rapid Response and Patch Deployment **Metabase** swiftly blocked the attack endpoints and rolled out a fix. Cloud customers have already been upgraded and patched, while organizations running self-hosted installations must update manually. Patched versions are available across affected branches from 0.58 through 0.63, with minimum safe releases being 0.58.24, 0.59.21, 0.60.17, 0.61.11, 0.62.9, and 0.63.5. For those unable to upgrade immediately, **Metabase** advises temporarily blocking access to the `/api/session/reset_password` endpoint. ## Post-Compromise Remediation Self-hosted customers are urged to immediately upgrade, revoke all active user sessions, review API keys and administrator accounts for unauthorized changes, rotate credentials for connected databases, and inspect logs and query history for signs of compromise. Attacks can be identified by a POST request to `/api/session/reset_password` returning a 400 status code, followed by a successful GET request to `/api/user/current`. System logs showing these entries likely indicate a compromise. ## Confirmed Customer Data Theft Laptop manufacturer **Framework** confirmed that customer information was stolen after its **Metabase** instance was compromised. The breach, which occurred on August 3, exposed full names, email addresses, login IP addresses, billing and shipping addresses, phone numbers, and company names. For **Framework for Business** customers, additional data like VAT and EIN may have been exposed. **Tally**, a popular online form builder, also notified users of a compromise to its **Metabase** analytics environment on August 3. Attackers accessed email addresses and password hashes. **Tally** stressed that forms and submitted answers, stored separately, were not affected. **LexisNexis** has also warned customers about a cyberattack impacting one of its third-party vendors, specifically mentioning its **Metabase API**. While the company did not explicitly link it to the zero-day, the timing and mention of **Metabase** suggest a connection. **LexisNexis** took affected systems offline and is investigating with a cybersecurity forensic firm. This incident underscores the critical importance of timely patching and robust security practices, particularly when dealing with widely used business intelligence platforms that process sensitive data.