## https://sploitus.com/exploit?id=46DF06DC-669D-5B3D-94F2-7AF869CB7CFF
# Metabase Pre-Authentication RCE (CVE-2023-38646)
CVE-2023-38646 is a remote code execution vulnerability in Metabase. This vulnerability stems from a security flaw in Metabase’s handling of unauthenticated API endpoints, such as `/api/setup/validate`. When processing these endpoints, Metabase improperly handles JDBC connection strings. Attackers can exploit this vulnerability by constructing specific JDBC connection strings and sending requests to `/api/setup/validate` with malicious connection strings, thereby executing arbitrary commands on the server without requiring authentication.
Specifically, attackers first obtain the `setup-token` by accessing `/api/session/properties`, and then use this token to send requests to `/api/setup/validate` with malicious JDBC connection strings. Due to insufficient security checks in Metabase for these requests, attackers can execute arbitrary code within the server’s permission scope. This vulnerability arises because Metabase fails to rigorously validate user-supplied JDBC connection strings when processing database connection configurations. Carefully crafted requests allow attackers to execute remote code.