Description

Metacat is data repository software that helps researchers preserve, share, and discover data. Metacat versions 2.0.0 through 3.4.0 contain an unauthenticated SQL injection vulnerability in the `/cn/v1/object` and `/cn/v2/object` REST API endpoints due to unsanitized user input that can be passed through to the backend SQL database. The `nodeId` parameter can be modified to inject SQL commands, and the results are returned in error messages. Metacat appends the user-supplied data into the sql query without sanitization or parameterization. This allows extraction of arbitrary data from the underlying PostgresQL database, fully exposing protected information to the attacker. This is accomplished by leveraging the error reporting mechanisms in Metacat, where SQL error responses are mirrored back to the caller in the XML error message returned by Metacat. One approach, for example, is to use the PostgreSQL `CAST` function to generate an error with the results of an arbitrary subquery, which is then injected into the XML error message returned by Metacat. Attackers do not need to be authenticated to execute the attack. In addition, arbitrary SQL statements that insert, update, and delete data in the Metacat database can be executed, resulting in full compromise of all data in the database. Full proof of concept attacks have been developed and verified for these vulnerabilities. The impact of this vulnerability is critical for Metacat deployments in the DataONE network where information from the database can be exfiltrated, added, changed, or deleted. This includes management information about the data catalog, access log information about who accessed data, identifying information about individuals including their ORCID identifier and client IP address, access control information about who should be able to access and modify data, and other critical internals of the data system. This sql injection vulnerability was remediated fully in Metacat version 3.4.1. If upgrading to Metacat 3.4.1 isn't immediately possible, most deployments can mitigate the issue by disabling the `/cn` REST endpoints in the webapp deployment. This API is not needed or used by member repositories in the DataONE network, as it is only used by the DataONE Coordinating Node deployments. Consequently, this API can be disabled without reduction of functionality for most deployments. To disable the vulnerable endpoints, simply remove the servlet and servlet-mapping for the `/cn` endpoints in the servlet engine associated with the two servlets, `edu.ucsb.nceas.metacat.restservice.v1.CNRestServlet` and `edu.ucsb.nceas.metacat.restservice.v2.CNRestServlet`. For example, in Tomcat, remove the relevant `servlet-mapping` elements from the application web.xml file in Metacat.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.8",
  "pubDate": "2026-08-14T18:17:27.993Z",
  "pubdate": "2026-08-14T18:17:27.993Z",
  "executiveSummary": "Metacat versions 2.0.0 through 3.4.0 suffer from a critical unauthenticated SQL injection vulnerability residing within the REST API endpoints.\nThe flaw allows unauthenticated remote attackers to supply unsanitized input via the nodeId parameter, leading to direct execution of arbitrary SQL commands against the underlying PostgreSQL database.\nExploitation enables complete compromise of the database through data exfiltration, insertion, modification, and deletion.\nAttackers can leverage error-based SQL injection techniques, utilizing functions like CAST to force database error messages to mirror sensitive query results back to the caller within XML error responses.\nImpacted data includes data catalogs, access logs, personally identifiable information such as ORCID identifiers and client IP addresses, access control lists, and core system internals.\nThis vulnerability poses a severe risk to deployments participating in the DataONE network, fully compromising confidentiality, integrity, and availability.",
  "technicalDetails": "The vulnerability is caused by improper input validation and the lack of parameterized queries in Metacat versions 2.0.0 through 3.4.0.\nThe vulnerable components are the REST API endpoints /cn/v1/object and /cn/v2/object, handled by the servlets edu.ucsb.nceas.metacat.restservice.v1.CNRestServlet and edu.ucsb.nceas.metacat.restservice.v2.CNRestServlet.\nThe root cause stems from the application appending user-supplied data from the nodeId parameter directly into SQL queries without sanitization or parameterization.\nAttackers can interact with these endpoints over the network without requiring any authentication or privileges.\nDuring the attack flow, a malicious actor submits a specially crafted payload via the nodeId parameter in an HTTP request directed at the /cn/v1/object or /cn/v2/object endpoints.\nBecause the input is unsanitized, the backend PostgreSQL database interprets the injected strings as executable SQL statements.\nTo extract data without direct read access to standard query outputs, attackers leverage error-based exploitation mechanisms. For example, utilizing the PostgreSQL CAST function forces the database to generate a runtime conversion error that incorporates the results of an arbitrary SQL subquery.\nMetacat catches the resulting database error and mirrors the raw SQL error response back to the caller inside an XML error message.\nBeyond data exfiltration, the vulnerability permits arbitrary SQL write operations, allowing attackers to execute INSERT, UPDATE, and DELETE statements to alter application and management data.\nPost-exploitation impact includes the full exposure and manipulation of sensitive data managed by the data repository and DataONE network deployments."
}