Active Kubernetes RCE Attack Relies on Known OpenMetadata Vulns

Editor's note: On 4-25-24 this article was updated to include a statement from OpenMetadata.

Known vulnerabilities in OpenMetadata's open source metadata repository have been under active exploit since the beginning of April, allowing threat actors to launch remote code execution cyberattacks against unpatched Kubernetes clusters, according to research from Microsoft Threat Intelligence.

OpenMetadata is an open source platform that operates as a management tool as well as a central repository for metadata. In mid-March, researchers published information on five new vulnerabilities (CVE-2024-28255, CVE-2024-28847, CVE-2024-28253, CVE-2024-28848, CVE-2024-28254) that affected versions preceding v1.3.1, according to Microsoft's report.

And while many cybersecurity teams might have missed the advisory, adversaries picked up on the opportunity to break into vulnerable Kubernetes environments and leverage them for cryptocurrency mining, the vendor said.

"In this case, a vulnerable Kubernetes workload which is exposed to the Internet got exploited," Microsoft researcher Yossi Weizman explains. While the cybercriminals were engaged in crypto mining, he warns there's a wide range of nefarious activity an adversary can engage in once they're inside a Kubernetes cluster.

"In general (not specifically in this case), once attackers have control over a workload in the cluster, they can try to leverage this access also for lateral movement, both inside the cluster and also to external resources," Weizman adds.

OpenMetadata administrators are advised to update, use strong authentication, and reset any default credentials in use.

A statement provided by an OpenMetadata spokesman explained the most critical of these vulnerabilities (CVE-2024-28255 and CVE-2024-28254) as well as two others (CVE-2024-28847 and CVE-2024-28848) were issued patched on Jan 5.

"The remaining CVE-2024-28253 only applies to existing users that are already registered and authenticated within OpenMetadata," the statement continued. "This was patched in 1.3.1 in March."

The spokesman added the OpenMetadata security page provides additional details.