漏洞描述
Metabase is an open source data analytics platform. In affected versions a local file inclusion security issue has been discovered with the custom GeoJSON map (`admin->settings->maps->custom maps->add a map`) support and potential local file inclusion (including environment variables). URLs were not validated prior to being loaded.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/metabase/metabase/security/advisories/GHSA-w73v-6p7p-fpfr↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-41277↗twitter.comhttps://twitter.com/90security/status/1461923313819832324↗github.comhttps://github.com/metabase/metabase/commit/042a36e49574c749f944e19cf80360fd3dc322f0↗github.comhttps://github.com/pen4uin/vulnerability-research-list↗