Metacat versions 2.0.0 through 3.4.0 have an unauthenticated SQL injection vulnerability in the /cn/v1/object and /cn/v2/object REST API endpoints due to unsanitized user input in the nodeId parameter. This allows attackers to inject arbitrary SQL commands that are executed by the backend PostgreSQL database. Exploitation can lead to full disclosure, modification, and deletion of data in the Metacat database. The vulnerability leverages error message reflection to extract data via SQL error responses embedded in XML error messages. Proof-of-concept exploits have been verified. The vulnerability is fully fixed in version 3.4.1. If immediate upgrade is not possible, disabling the /cn endpoints by removing the associated servlets and servlet-mappings in the web.xml file mitigates the risk.

An unauthenticated attacker can exploit this vulnerability to extract, modify, or delete any data in the Metacat PostgreSQL database. This includes sensitive information such as data catalog management details, access logs, user identifiers (including ORCID), client IP addresses, and access control information. The vulnerability allows full compromise of the database, posing a critical risk to confidentiality, integrity, and availability of the data managed by Metacat, especially in DataONE network deployments.

A full fix is available in Metacat version 3.4.1. Users should upgrade to this version to remediate the vulnerability. If upgrading immediately is not feasible, the vulnerability can be mitigated by disabling the /cn REST API endpoints, which are not required for most deployments. This is done by removing the servlet and servlet-mapping entries for edu.ucsb.nceas.metacat.restservice.v1.CNRestServlet and edu.ucsb.nceas.metacat.restservice.v2.CNRestServlet from the web.xml configuration file. This mitigation prevents exploitation without reducing functionality for most users.