writeups.xyz / Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646)

Submitter : c2a

Date: 22 July 2023

Bounty : undisclosed

Vulnerabilities :

• RCE
• SQL Injection
• Security Code Review

Programs :

• Metabase

Authors :

• Shubham Shah (@Infosec_au)
• Maxwell Garrett (@TheGrandPew)

Link :
https://blog.assetnote.io/2023/07/22/pre-auth-rce-metabase/