OpenMetadata SQL Injection Vulnerability in WorkflowDAO Interface

A SQL injection vulnerability has been identified in OpenMetadata versions through 1.4.1. The issue arises in the WorkflowDAO interface, specifically within the listCount function, where the workflowtype and status parameters are used to construct SQL queries. This vulnerability allows attackers to extract information from the database.

Impact

Exploitation of this vulnerability allows attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access, data manipulation, or in some cases, executing administrative commands on the database server.

Reproduction

To reproduce this vulnerability, send a GET request to the OpenMetadata API endpoint '/api/v1/automations/workflows' with crafted 'workflowType' and 'status' parameters that include SQL injection payloads. The injected SQL can be used to extract data from the database, such as table names or sensitive user information, depending on the injection technique used.