RCE and Arbitrary File Read in Metabase Enterprise Serialization Import

This repository is a compact proof-of-concept exploit for CVE-2026-33725 targeting Metabase Enterprise. It contains two files: a README describing the vulnerability, affected versions, and references; and a single Python exploit script, exploit.py, which is the operational entry point. The exploit abuses the Metabase EE serialization import feature by uploading a crafted tar.gz archive containing a malicious database YAML definition under export/databases/<name>/<name>.yaml. The YAML sets engine: h2 and injects attacker-controlled content into the H2 JDBC subname/INIT parameter. After import, the script forces Metabase to connect to the imported database by calling /api/database/<id>/sync_schema, /api/database/<id>/rescan_values, and /api/dataset with a native SELECT 1 query. This causes the H2 INIT payload to execute. The script supports two modes: 1. Safe/proof mode: writes a marker file to a target path (default /tmp/metabase_poc_pwned.txt) using H2 CSVWRITE, demonstrating arbitrary file write. 2. RCE mode (--cmd): generates Clojure code that invokes clojure.java.shell/sh with /bin/sh -c <command>, writes that code to a temporary file via CSVWRITE, creates an H2 alias to clojure.lang.Compiler.loadFile, and loads the file to execute the supplied OS command. Operationally, the exploit requires a Metabase base URL and an admin session token. It first probes /api/ee/serialization/import to distinguish OSS vs EE behavior and optionally supports an HTTP proxy. It also attempts to delete any preexisting database with the same generated name before importing the malicious archive. Overall, this is a real exploit rather than a detector: it performs authenticated remote exploitation over HTTP against Metabase EE administrative APIs and can achieve arbitrary file write or command execution on vulnerable servers.