Local File Inclusion in Metabase GeoJSON API (CVE‑2021‑41277) Threatens Data Exposure

Local File Inclusion in Metabase GeoJSON API (CVE‑2021‑41277) Threatens Data Exposure

What It Is

Metabase’s custom‑map feature accepts GeoJSON payloads via a public API endpoint. A flaw in the request‑parsing logic allows an attacker to supply a crafted file path, causing the server to read arbitrary files from the host filesystem and return their contents in the API response.

Exploitability

• CVSS v3.1 base score: 6.5 (Medium).
• Public proof‑of‑concept code is available on open‑source repositories.
• No confirmed large‑scale exploitation reports, but the vulnerability is actively exploitable by any network‑reachable Metabase instance that accepts unauthenticated GeoJSON requests.

Affected Products

• Metabase – all self‑hosted versions prior to the vendor‑released fix (0.41.5).
• The issue applies to any deployment where the GeoJSON API is exposed, regardless of operating system or cloud environment.

Why It Matters for Compliance & Audit Readiness

The ability to read arbitrary files undermines vendor‑management controls and continuous monitoring requirements. Evidence of unpatched LFI can be cited during audits of frameworks such as NIST CSF (PR.IP‑1) or ISO 27001 (A.12.6.1). Demonstrating timely patching, network segmentation of the Metabase API, and documented file‑integrity monitoring provides a defensible audit trail that shows due diligence in protecting data confidentiality and integrity.

Recommended Actions

• Inventory all Metabase instances and verify current version.
• Upgrade to Metabase 0.41.5 or later; apply any subsequent security patches.
• If immediate upgrade isn’t possible, block the /api/public/geojson endpoint at the firewall or reverse‑proxy level.
• Enable file‑integrity monitoring (e.g., OSSEC, Tripwire) on the Metabase host to detect unexpected reads.
• Update your asset inventory and map the remediation to the relevant control (e.g., NIST PR.IP‑1, ISO A.12.6.1).
• Document the remediation steps and retain logs as evidence of control assurance for future audits.

Source: https://nvd.nist.gov/vuln/detail/CVE-2021-41277