CVE-2024-28847

CVE-2024-28847 is a critical Remote Code Execution (RCE) vulnerability affecting OpenMetadata versions prior to 1.2.4. It stems from an expression language injection flaw (CWE-94) in the AlertUtil::validateExpression function, allowing authenticated attackers to execute arbitrary code by sending a crafted PUT request to the /api/v1/events/subscriptions endpoint. This vulnerability carries a high CVSS score of 8.8, indicating a network-based attack with low complexity, requiring only low privileges, and resulting in high impacts to confidentiality, integrity, and availability. The authorization check occurs after the malicious expression is evaluated, making it exploitable. While no public exploit code is listed on Metasploit, Nuclei, or ExploitDB, this vulnerability is actively exploited in the wild, with reports of attackers hijacking OpenMetadata applications in Kubernetes for cryptomining. It has garnered significant community discussion and media coverage, including articles from BleepingComputer and SecurityWeek, highlighting its active exploitation.