Metabase Pre Authentication RCE (CVE-2023-38646)

CVE-2023-38646 is a remote code execution vulnerability in Metabase. The vulnerability stems from a security flaw in Metabase's handling of JDBC connection strings when processing the unauthenticated API endpoint /api/setup/validate. An attacker can construct a specific JDBC connection string to exploit this endpoint and execute arbitrary commands on the server without authentication.

Specifically, an attacker first obtains the setup-token by accessing /api/session/properties, then uses that token to send a request containing a malicious JDBC connection string to /api/setup/validate. Due to Metabase's lack of sufficient security validation for these requests, the attacker can execute arbitrary code within the server's privileges.

This vulnerability exists mainly because Metabase does not strictly validate user-supplied JDBC connection strings when processing database connection configurations, allowing attackers to achieve remote code execution through carefully crafted requests.