CVE-2021-31602

Related Files

Pentaho Business Analytics / Pentaho Business Server 9.1 SQL Injection

Posted Nov 5, 2021

Authored by Altion Malka, Alberto Favero

Pentaho allows users to create and manage Data Sources. Users can select a Data Source when creating a Dashboard through the Pentaho User Console. When a Data Source is added, Pentaho makes a HTTP request to the dashboards editor (/pentaho/api/repos/dashboards/editor) in order to test the connection by executing a test SQL query. However, further examination revealed that by utilizing CVE-2021-31602, an authentication bypass of Spring APIs, it is possible for an unauthenticated user to execute arbitrary SQL queries on any Pentaho datasource and thus retrieve data from the related databases.

tags | exploit, web, arbitrary, sql injection

advisories | CVE-2021-31602, CVE-2021-34684

SHA-256 | aafd5de6352edfc97e93496f171ced94b49f52a6817c483a7aec6ee26649a0e9

Download | Favorite | View

Pentaho Business Analytics / Pentaho Business Server 9.1 Authentication Bypass

Posted Nov 5, 2021

Authored by Altion Malka, Alberto Favero

Pentaho Business Analytics and Pentaho Business Server versions 9.1 and below suffer from an authentication bypass vulnerability related to Spring APIs.

tags | exploit, bypass

advisories | CVE-2021-31602

SHA-256 | 7f8a25e1b9943928e3d57e11e94b4b22917396971502415544f387e2340268c3

Download | Favorite | View