CVE-2022-43776 — The url parameter of the /api/geojson endpoint in Metabase versions <44.5 can be used to perform Server Side Request Forgery attacks

Matched remediation archetype

Server-side request forgery and unintended proxying

This catalog composition supplies bounded fallback guidance. Explicitly reviewed curated workflows load with the complete record below.

Check exposure

• Inventory server-side URL fetchers, webhooks, importers, previews, redirects, proxies, and protocol handlers reachable from untrusted input.
• Map egress paths to internal services, metadata endpoints, loopback, private address space, and privileged control planes.
• Review DNS resolution, redirect, proxy, credential-forwarding, and URL parsing behavior without requesting sensitive targets.

Remediate safely

• Replace arbitrary destinations with named integrations or a strict allowlist of schemes, hosts, ports, and paths.
• Resolve and validate every destination and redirect hop, then enforce egress policy independently of application checks.
• Remove ambient credentials and sensitive headers from fetchers; apply response size, time, and content limits.