Chaining our way to Pre-Auth RCE in Metabase (CVE-2023-38646)::Application security issues found by Assetnote