OpenMetadata SQL Injection Vulnerability in TestDefinitionDAO Interface

A SQL injection vulnerability has been identified in OpenMetadata versions through 1.4.4. The issue arises in the TestDefinitionDAO interface, specifically within the listCount function. An authenticated, low-privileged remote attacker can exploit this vulnerability by manipulating the testPlatform parameter to craft a SQL query that extracts information from the database.

Impact

Exploitation of this vulnerability allows for unauthorized data extraction from the database, potentially leading to information disclosure.

Reproduction

To reproduce this vulnerability, an authenticated user with low privileges can send a request to the OpenMetadata API endpoint 'api/v1/dataQuality/testDefinitions' while including a crafted testPlatform parameter. This parameter will be used to build a SQL query, exploiting the application's SQL injection vulnerability. The listCount function in the TestDefinitionDAO interface will execute the query, allowing the attacker to extract database information.