21–30 of 76 posts
It would be nice to know if this vulnerability affects people who never made their Metabase installations publicly accessible. Aka if I am running Metabase locally.
How would an attacker exploit that?
Will it still be (as) dangerous if Metabase is running inside a container?
To all of the auth tokens and user creds? Why not.
How many of you have received this notice via an official security advisory channel you're monitoring/acting on? If so, which advisory service do you use and how you configure it? Learning about HN is useful, but far from a reliable solution.
It would be nice to know if this vulnerability affects people who never made their Metabase installations publicly accessible. Aka if I am running Metabase locally.
Earlier quoted context omitted.
I didn't even know you could have a "private" commit on GitHub/an open source repo like that.
Oh, I didn't mean to imply you can, just that it's 404... presumably it exists in a repo checked out on someone's machine, and maybe in a separate private Github repo.
Also like, note: I would never publicly disclose whatever I find, I'm just curious
I observed exactly what you said about the Clojure filenames not matching up, etc. etc.
#!/bin/bash
# Variables
DIR1=~/metabase-v0.46.6.jar.src # decompiled with jd-cli / jd-gui (java decompiler)
DIR2=~/metabase-v0.46.6.1.jar.src # decompiled with jd-cli / jd-gui (java decompiler)
# Function to create fuzzy hash for each file in a directory
create_fuzzy_hashes() {
dir=$1
for file in $(find $dir -type f)
do
ssdeep -b $file >> ${dir}/hashes.txt
done
}
# Create fuzzy hashes for each file in the directories
create_fuzzy_hashes $DIR1
create_fuzzy_hashes $DIR2
# Compare the hashes
ssdeep -k $DIR1/hashes.txt $DIR2/hashes.txt
I was thinking this, or binary diffing the .class (instead of the "decompiled" .java)?
Earlier quoted context omitted.
How would an attacker exploit that?
A vulnerability (not necessarily this one, just hypothesising) could be exploited via a payload result from an outbound request to the internet.
How many of you have received this notice via an official security advisory channel you're monitoring/acting on? If so, which advisory service do you use and how you configure it? Learning about HN is useful, but far from a reliable solution.
Earlier quoted context omitted.
Oh, I didn't mean to imply you can, just that it's 404... presumably it exists in a repo checked out on someone's machine, and maybe in a separate private Github repo.
This is silly on my end (I woke up early and have time to kill)... Also like, note: I would never publicly disclose whatever I find, I'm just curious I observed exactly what you said about the Clojure filenames not matching up, etc. etc. #!/bin/bash # Variables DIR1=~/metabase-v0.46.6.jar.src # decompiled with jd-cli / jd-gui (java decompiler) DIR2=~/metabase-v0.46.6.1.jar.src # decompiled with jd-cli / jd-gui (java…