Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Tell HN: Upgrade your Metabase installation

github.com

Post reply on HN
Print view View original

41–50 of 76 posts

Re: Tell HN: Upgrade your Metabase installation

#41

Post by namaria »

hannofcart wrote: post #36

One of the better decisions we took at my firm was to not allow direct access to any production DB to analytics visualization tools like Metabase and Redash. Always write your analytics data to a separate DB in a periodically run job. Only store aggregated anonymized data in the analytics DB you expose to internal stakeholders via tools like Metabase.

That's a great idea and it articulates something I have thought about the whole "use boring tech" things (which I support). It doesn't preclude letting people use the shiny new thing. You can always let them plug it in and use it. But the core of the system should be as simple as possible and based on thoroughly understood tech (from the point of view of the team in question/accessible labor market).

Re: Tell HN: Upgrade your Metabase installation

#42

Post by worthless-trash »

not_your_vase wrote: post #31
lecha wrote: post #18

How many of you have received this notice via an official security advisory channel you're monitoring/acting on? If so, which advisory service do you use and how you configure it? Learning about HN is useful, but far from a reliable solution.

It is definitely not announced on Full Disclosure nor on oss-security mailing lists.

Doesn't look like there is a CVE either: https://www.cvedetails.com/vulnerability-list/vendor_id-1947...

Re: Tell HN: Upgrade your Metabase installation

#43

Post by bdonlan »

hadrien01 wrote: post #15
vxNsr wrote: post #6

Earlier quoted context omitted.

They say they’ll be releasing the patch publicly, but isn’t this OSS, can’t anyone just do a diff and with a little “elbow grease” find the patch?

> Yes, we’ll be releasing the patch publicly, as well as a CVE and an explanation in two weeks. We’re delaying release to give our install base a bit of extra time before this is widely exploited.

Unfortunately that means it's not possible to deploy this without violating the AGPL...

Re: Tell HN: Upgrade your Metabase installation

#44

Post by jabart »

bdonlan wrote: post #43
hadrien01 wrote: post #15

Earlier quoted context omitted.

> Yes, we’ll be releasing the patch publicly, as well as a CVE and an explanation in two weeks. We’re delaying release to give our install base a bit of extra time before this is widely exploited.

Unfortunately that means it's not possible to deploy this without violating the AGPL...

No one cares. It's a two week violation and no one is going to hunt anyone down who released this early internally.

Re: Tell HN: Upgrade your Metabase installation

#45

Post by konschubert »

fuomag9 wrote: post #16
tedeh wrote: post #10

Earlier quoted context omitted.

Ha, I was just about to go in here and say the same thing. "Fortunately" some "white hat" hacker contacted us last year about another Metabase exploit. I gave him a 30 USD tip and ended up doing exactly what you are suggesting. Now I'm glad that means I don't need to interrupt my vacation to fix this thing right now.

Here in Italy you get lucky if the company is not suing you :(

EDIT: I misunderstood.

Re: Tell HN: Upgrade your Metabase installation

#46

Post by vdfs »

kevincox wrote: post #3

This is why I try to put everything behind NGINX with basic auth. Unfortunately not everything works well that way but in this case I suspect that this is made unexploitable by anyone without the password.

Hmm, I was thinking that's a standard thing, atleast in HN crowd. basic setup Cloudflare -> Nginx -> Docker -> 3rd Party app, all on a dedicated vm

Re: Tell HN: Upgrade your Metabase installation

#48

Post by Nextgrid »

bdonlan wrote: post #43
hadrien01 wrote: post #15

Earlier quoted context omitted.

> Yes, we’ll be releasing the patch publicly, as well as a CVE and an explanation in two weeks. We’re delaying release to give our install base a bit of extra time before this is widely exploited.

Unfortunately that means it's not possible to deploy this without violating the AGPL...

Even though this is technically a violation, licenses aren't black & white. The objective and intent of the AGPL is not being violated by delaying release by a couple weeks to give time for security patches to be applied.

Re: Tell HN: Upgrade your Metabase installation

#49

Post by 98codes »

hannofcart wrote: post #36

One of the better decisions we took at my firm was to not allow direct access to any production DB to analytics visualization tools like Metabase and Redash. Always write your analytics data to a separate DB in a periodically run job. Only store aggregated anonymized data in the analytics DB you expose to internal stakeholders via tools like Metabase.

Exactly right -- we do all of that, and even then tightly control and audit who has access to the anonymized, aggregated, read-only data cube.

Re: Tell HN: Upgrade your Metabase installation

#50

Post by calessian »

konschubert wrote: post #45
fuomag9 wrote: post #16

Earlier quoted context omitted.

Here in Italy you get lucky if the company is not suing you :(

EDIT: I misunderstood.

That’s simply not true, sadly; you’re very much reliant on the company not attempting to sue you. Counter examples (not implying these have been successful, but it is also not unheard of to have the police show up at your door and collect all computers/phones etc. to investigate)

- https://www.golem.de/news/connect-app-cdu-verklagt-offenbar-... - https://www.heise.de/news/Modern-Solution-Anklage-gegen-Aufd...

Post reply on HN