OpenMetadata SQL Injection Vulnerability in TestDefinitionDAO Interface

A SQL injection vulnerability has been identified in OpenMetadata versions through 1.4.4. The issue arises in the 'listCount' function of the 'TestDefinitionDAO' interface, where the 'supportedDataTypeParam' parameter is improperly sanitized before being used to construct SQL queries. This flaw allows attackers to manipulate the parameter and execute arbitrary SQL commands, potentially leading to unauthorized data access or modification.

Impact

Exploitation of this vulnerability allows for SQL injection, where an attacker can interfere with the application's database queries. This could lead to unauthorized data access, data manipulation, or in some cases, executing administrative operations on the database.

Reproduction

To reproduce this vulnerability, send a request to the OpenMetadata API endpoint 'api/v1/dataQuality/testDefinitions' with a crafted 'supportedDataTypeParam' parameter. The injected SQL payload should exploit the 'listCount' function in the 'TestDefinitionDAO' interface, bypassing any input validation and manipulating the SQL query to extract database information.