CVE-2025-50467

CVE-2025-50467.txt

[Suggested description]
OpenMetadata <=1.4.4 is vulnerable to SQL Injection. An attacker can
extract information from the database in function listCount in the
TestDefinitionDAO interface. The supportedDataTypeParam parameter can
be used to build a SQL query.

------------------------------------------

[Additional Information]
### Details
The open-metadata project exposes the function listCount in TestDefinitionDAO interface at the API URL api/v1/dataQuality/testDefinitions. The supportedDataTypeParam parameter is directly used to build a SQL query in line 3527,3528 as it can be seen in the following snippet:

![image](https://gist.github.com/user-attachments/assets/8103a493-a447-4c58-96e1-f47281d6e6e3)

------------------------------------------

[Vulnerability Type]
SQL Injection

------------------------------------------

[Vendor of Product]
 open-metadata

------------------------------------------

[Affected Product Code Base]
open-metadata 1.4.4 - =<1.4.4

------------------------------------------

[Attack Type]
Remote

------------------------------------------

[Impact Escalation of Privileges]
true

------------------------------------------

[Impact Information Disclosure]
true

 ------------------------------------------

[Attack Vectors]
 ### Summary
A SQL injection vulnerability exists in open-metadata 1.4.4 where an authenticated, low-privileged remote attacker could extract information from the database.
 ### Details
 The open-metadata project exposes the function listCount in TestDefinitionDAO interface at the API URL api/v1/dataQuality/testDefinitions. The supportedDataTypeParam parameter is directly used to build a SQL query in line 3527,3528
 =========================================-

[Reference]
https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3527
https://github.com/open-metadata/OpenMetadata/blob/4b9145a9da7ed95b7f868ab9f351e3d759af47d7/openmetadata-service/src/main/java/org/openmetadata/service/jdbi3/CollectionDAO.java#L3528