CVE-2021-31599

Related Files

Pentaho Business Analytics / Pentaho Business Server 9.1 Remote Code Execution

Posted Nov 5, 2021

Authored by Altion Malka, Alberto Favero

Pentaho allows users to create and run Pentaho Report Bundles (.prpt). Users can create PRPT reports by utilizing the Pentaho Designer application and can include BeanShell Script functions to ease the production of complex reports. However, the BeanShell Script functions can allow for the execution of arbitrary Java code when Pentaho PRPT Reports are run by Pentaho Business Analytics. This functionality allows any user with sufficient privileges to upload or edit an existing Pentaho Report Bundle (through Pentaho Designer) and execute arbitrary code in the context of the Pentaho application user running on the web server.

tags | exploit, java, web, arbitrary

advisories | CVE-2021-31599

SHA-256 | 9f8cbd9f5ed4747e5a6fd8e34452cf38b7608a4e96f8f1551a4a3068ced96949

Download | Favorite | View