CVE-2021-41277: Metabase GeoJSON API Local File Inclusion Vulnerability

CVE-2021-41277 is a local file inclusion issue in Metabase that affects the custom map support in its API for reading GeoJSON formatted data. An attacker who can reach the vulnerable API endpoint may be able to cause the application to read files from the local filesystem and return their contents, exposing sensitive information that should not be accessible. Because Metabase is commonly used for business intelligence and analytics, successful abuse can reveal configuration files, credentials, or other data stored on the host, increasing the risk of further compromise. Confirm all product and version details against the vendor advisory before acting.

How it works

The weakness is classified as CWE-200 (exposure of sensitive information to an unauthorized actor). According to the CISA summary, Metabase contains a local file inclusion vulnerability in the custom map support within the API that handles GeoJSON data. In this class of flaw, the application accepts a path or reference that is intended to point to legitimate GeoJSON map resources but does not sufficiently restrict or validate it. An attacker who can interact with the affected API can supply a crafted reference that causes the server to open and return the contents of an arbitrary local file instead of (or in addition to) the expected map data. The result is unauthorized disclosure of filesystem contents to the requester. Exact request parameters, authentication requirements, and exploitation mechanics are not detailed here and must be confirmed against the vendor advisory; do not assume unauthenticated access or specific payload formats without that verification.

Am I affected? How to find it in your systems

Metabase is a business-intelligence and analytics platform typically deployed as a web application, often on internal networks, cloud instances, or container platforms, and used by data and operations teams. Inventory every instance by searching configuration management databases, container registries, package inventories, and network service scans for Metabase processes or listening ports associated with the product. Review deployment manifests, Docker images, and package versions against the ranges listed in the vendor advisory for this CVE; any installation that exposes the GeoJSON/custom-map API functionality should be treated as potentially affected until confirmed otherwise. Check application and reverse-proxy logs for unusual requests targeting map or GeoJSON-related endpoints, especially those containing path traversal sequences or references to sensitive system files. Network telemetry showing unexpected outbound or internal file-access patterns from the Metabase host can also indicate probing. Because public detail on exact vulnerable configurations is limited, always cross-check your findings with the official vendor advisory.

How to remediate

Apply the vendor-supplied update or mitigation for Metabase as the primary remediation step; follow the instructions in the official advisory exactly. After patching, verify that the GeoJSON custom-map API no longer permits arbitrary file reads by testing with non-sensitive paths under controlled conditions. For this class of local file inclusion and information-exposure weakness, harden the deployment by ensuring the Metabase process runs with least privilege, restricting its filesystem access to only the directories it requires, and disabling any unused custom-map or GeoJSON features if the product configuration allows it. Review and tighten authentication and authorization controls on the API so that only trusted users or services can reach the affected endpoints. Re-scan the environment after changes to confirm the vulnerability is no longer present.

If you can't patch immediately

Until the vendor update can be applied, reduce exposure with compensating controls. Segment the Metabase host so that only necessary internal clients can reach its web and API ports; block direct internet access if it is not required. If a web application firewall or reverse proxy sits in front of Metabase, implement virtual-patching rules that reject requests containing path-traversal patterns or unexpected file references aimed at the GeoJSON/map endpoints—test rules carefully to avoid breaking legitimate map functionality. Disable the custom map support feature entirely if business needs allow. Increase monitoring: alert on anomalous API calls, failed or successful reads of sensitive paths, and unusual process activity on the host. These measures lower risk but do not eliminate it; schedule the official patch as soon as possible. The CISA-required action is to apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to breaches in which local files containing credentials, configuration, or other sensitive data are exfiltrated. If logs or other indicators suggest the GeoJSON API was abused, treat the host as potentially compromised: rotate any secrets that may have resided on the filesystem, review access logs for lateral movement, and follow your incident-response procedures. Known ransomware use of this CVE is not documented. As a further check, you can run a free exposure scan of your email addresses against known breach data sets to determine whether related credentials have already appeared in public dumps.