CVE-2022-43939

Related Files

Pentaho Business Server Authentication Bypass / SSTI / Code Execution

Posted May 11, 2023

Authored by jheysel-r7, dwbzn, Harry Withington | Site metasploit.com

Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is vulnerable to an authentication bypass (CVE-2022-43939) and a Server Side Template Injection (SSTI) vulnerability (CVE-2022-43769) that can be chained together to achieve unauthenticated code execution as the user running the Pentaho Business Analytics Server. The first vulnerability (CVE-2022-43939) is an authentication bypass which stems from a regex that allows any URL that ends in "/", followed by "require", optionally "-js" or "-cfg", any character, and then the string "js" followed optionally by "?" and then any characters of the attacker's choice. The second (CVE-2022-43769) is a server side template injection. This vulnerability allows remote code execution by making a GET request to /api/ldap/config/ldapTreeNodeChildren and setting the url parameter to ThymeLeaf template code. By abusing the ability to execute arbitrary Java classes within Thymeleaf templates, an attacker can execute arbitrary commands as the user running the Pentaho Business Analytics Server.

tags | exploit, java, remote, arbitrary, code execution

advisories | CVE-2022-43769, CVE-2022-43939

SHA-256 | 85e7f9076fc208c9c4ebe24ee580c0390563fe0f0db89e01aa897a906b078801

Download | Favorite | View

Pentaho BA Server EE 9.3.0.0-428 Server-Side Template Injection / Remote Code Execution

Posted Apr 5, 2023

Authored by dwbzn

Pentaho BA Server EE version 9.3.0.0-428 suffers from a remote code execution vulnerability via a server-side template injection flaw.

tags | exploit, remote, code execution

advisories | CVE-2022-43769, CVE-2022-43939

SHA-256 | a9d828e59ed327ca4a340b2652a01dc55a7871e87b98ce66c4dafab42d88662c

Download | Favorite | View