---
title: "Metabase GeoJSON LFI (CVE-2021-41277)"
canonical: https://trickest.com/library/cve-2021-41277-metabase-geojson-lfi
description: "Flag Metabase hosts for CVE-2021-41277 by reading version.tag from /api/session/properties. Only x.40.0-x.40.4. No GeoJSON fetch."
---

# Metabase GeoJSON LFI (CVE-2021-41277)

## Overview

This workflow finds Metabase and sorts each host by whether its shared feature version falls in the CVE-2021-41277 window. CVE-2021-41277 is unauthenticated local file inclusion through Metabase custom GeoJSON map support. This check never hits `/api/geojson` and never asks the server to load a file. Give it hostnames, IP addresses, or URLs you are authorised to test. The workflow GETs `/api/session/properties`, fingerprints Metabase from that JSON, reads `version.tag`, normalizes to the shared minor.patch line across OSS and Enterprise, and compares it to the floors in the graph. Every host comes back affected or not, so a fleet advisory becomes an evidenced list for [exposure management](/use-cases/exposure-management). Only the x.40.0 through x.40.4 line is flagged.

Run it on a schedule when analytics hosts turn over. A new Metabase spin-up on the old 0.40 or 1.40 line is the reason the same fingerprint is worth more next week than this week.

## Pipeline

1. Read the target list. Hosts, URLs, or ranges, one per line, become the scope.
2. GET `/api/session/properties` on each host and fingerprint Metabase from JSON keys such as `version`, `tag`, `setup-token`, and `engines`.
3. Parse `version.tag`, drop the leading edition digit, and compare the shared minor.patch value to the CVE-2021-41277 floors in the graph.
4. Collect the per-host rows: product match, version, vulnerable flag, and any fetch error.
5. Emit the summary counts: hosts checked, product hits, vulnerable, and errors.

## Inputs

- **Target scope.** Hostnames, IP addresses, CIDR ranges, or URLs, one per line. Full URLs and host:port entries work too, since the workflow normalizes each into a bare host. Point it at scope you are authorised to test.

## Outputs

- **results.jsonl.** One row per host: URL, whether Metabase was detected, the version read, the vulnerable flag, and detail text.
- **findings.jsonl.** The same per-host verdict shaped for triage, with severity set from the vulnerable flag.
- **summary.json.** Counts across the list: targets, product hits, vulnerable, and errors, plus the detection notes from the graph.

## Integrations

- HTTP. Unauthenticated GET of `/api/session/properties` only. No `/api/geojson` request and no file-inclusion probe.

## Sample output

The records below are illustrative and do not come from a real run. They show one Metabase host on the affected 40.x line, one at or above 40.5, and one host that is not the product.

```jsonl
{"url": "https://bi.example.com", "is_product": true, "product_version": "40.3", "vulnerable": true, "detail": "below fixed release 40.5"}
{"url": "https://bi.example.org", "is_product": true, "product_version": "40.5", "vulnerable": false, "detail": "at or above fixed release"}
{"url": "https://shop.example.net", "is_product": false, "product_version": null, "vulnerable": false, "detail": "not identified as Metabase"}
```

```json
{"cve": "CVE-2021-41277", "total_targets": 3, "product_detected": 2, "vulnerable": 1, "errors": 0}
```

## FAQ

### Which Metabase versions does this flag?

Only the shared x.40.0 through x.40.4 line. The graph treats 0.40.5 (OSS) and 1.40.5 (Enterprise) as the floors. Other minor lines are not flagged. The compare uses the `version.tag` value Metabase itself served.

### Does an affected row mean a local file was read?

No. The check only GETs `/api/session/properties` and reads the version tag. It does not call `/api/geojson` and it does not confirm LFI.

### Is this check safe on production?

Yes. It is a read-only unauthenticated GET of the public session-properties endpoint. It does not log in or load a GeoJSON URL.

### Does the check need credentials?

No. `/api/session/properties` answers without a session on exposed Metabase hosts.

### What is CVE-2021-41277?

Unauthenticated local file inclusion in Metabase custom GeoJSON map support. This workflow maps hosts to that CVE by version exposure only.

## Related workflows

- [Metabase SQLi (CVE-2026-72898)](/library/metabase-sql-injection-check-cve-2026-72898). Reach for it when you need a later Metabase SQL injection exposure check.
- [Grafana snapshot auth bypass (CVE-2021-39226)](/library/cve-2021-39226-grafana-snapshot-auth-bypass). Reach for it when the next analytics host is Grafana, not Metabase.

---
_Markdown source of https://trickest.com/library/cve-2021-41277-metabase-geojson-lfi._