What this checks: whether a Metabase host runs a version affected by unauth GeoJSON local file inclusion. Read-only: it fingerprints Metabase and reads the version, no exploitation.
3. Detection — reads the Metabase version from the version exposed at /api/session/properties, compares to 0.40.5 (OSS) / 1.40.5 (Enterprise); only the x.40.0-x.40.4 releases are affected. Flags vulnerable on an affected build. No exploitation.
1. Target List — paste your Metabase URLs here, one per line (e.g. https://host.example.com).
Overview
This workflow finds Metabase and sorts each host by whether its shared feature version falls in the CVE-2021-41277 window. CVE-2021-41277 is unauthenticated local file inclusion through Metabase custom GeoJSON map support. This check never hits /api/geojson and never asks the server to load a file. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs /api/session/properties, fingerprints Metabase from that JSON, reads version.tag, normalizes to the shared minor.patch line across OSS and Enterprise, and compares it to the floors in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for exposure management. Only the x.40.0 through x.40.4 line is flagged.
Run it on a schedule when analytics hosts turn over. A new Metabase spin-up on the old 0.40 or 1.40 line is the reason the same fingerprint is worth more next week than this week.
Pipeline
Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
GET /api/session/properties on each host and fingerprint Metabase from JSON keys such as version, tag, setup-token, and engines.
Parse version.tag, drop the leading edition digit, and compare the shared minor.patch value to the CVE-2021-41277 floors in the graph.
Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
Emit the summary counts: hosts checked, product hits, vulnerable, and errors.
Inputs
Target scope. Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.
Outputs
results.jsonl. One row per host: URL, whether Metabase was detected, the version read, the vulnerable flag, and detail text.
findings.jsonl. The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
summary.json. Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.
Integrations
HTTP. Unauthenticated GET of /api/session/properties only. No /api/geojson request and no file-inclusion probe.
Sample output
The records below are illustrative and do not come from a real run. They show one Metabase host on the affected 40.x line, one at or above 40.5, and one host that is not the product.
Only the shared x.40.0 through x.40.4 line. The graph treats 0.40.5 (OSS) and 1.40.5 (Enterprise) as the floors. Other minor lines are not flagged. The compare uses the version.tag value Metabase itself served.
Does an affected row mean a local file was read?
No. The check only GETs /api/session/properties and reads the version tag. It does not call /api/geojson and it does not confirm LFI.
Is this check safe on production?
Yes. It is a read-only unauthenticated GET of the public session-properties endpoint. It does not log in or load a GeoJSON URL.
Does the check need credentials?
No. /api/session/properties answers without a session on exposed Metabase hosts.
What is CVE-2021-41277?
Unauthenticated local file inclusion in Metabase custom GeoJSON map support. This workflow maps hosts to that CVE by version exposure only.