Hi, today I upgraded my self-hosted metabase instance to the latest as per Security update available for Metabase - Please upgrade now
I noticed the attack patterns in the application logs and I also found out an api_key was created alongside a new user - which was deactivated after the upgrade.
In order to assess the damage, is there any way to figure out what data was accessed using the api key?
The Metabase log should show all of the page hits, though I don’t know if the log entries indicate which hits came from an API call.
If you have a reverse proxy in front of Metabase, it would log the hits as well.
you should check query and query_execution tables, those will give you the queries that the attacker run (you need to see which user id the attacker impersonated and then which user id the api key got
Thanks! Yes that’s what I did.
Checked query_execution table for any access using auth_method api_key or execution_id impersonating the hacked user id.
Thankfully I don’t see any entries.
I wonder why the attacker may have just left it there and not go ahead? Perhaps no personal benefit? Anyway, I was glad that there was no access to the data itself.
Probably just scanned for vulnerable hosts and recorded the list for future exploration.
If they can’t easily get cloud API keys or deploy ransomware then its less interesting.
Does anyone know the details of the group who exploited and the totality of hosts affected or damaged done? Are there any reports anywhere?
No one has credited the attack yet.
That's unnerving. To check data access: filter query_execution by the compromised user_id and auth_method = 'api_key'. No entries = good sign.
Also check the activity table for dashboard views/exports during that window.
No public attribution yet—likely just automated scanning. They probably logged the key and moved on.
Rotate API keys and set up alerts for new key creations just to be safe.
Hope that helps!