Exploit Title: Improper authentication allows unauthenticated access to configuration files Product: Pentaho GA PDI & Pentaho GA BA Vulnerable Versions: 5.2.x GA BA Suite and PDI - Suite and previous versions Tested Version: 5.2.x GA BA Suite and PDI - Suite Advisory Publication: 15/02/2015 Latest Update: 15/02/2015 Vulnerability Type: Improper Authentication [CWE-287] CVE Reference: CVE-2015-6940 Credit: Gregory DRAPERI Advisory Details: (1) Vendor & Product Description -------------------------------- Vendor: PENTAHO Product & Version: 4.3.x GA PDI - Suite 4.4.x GA PDI - Suite 4.5.x GA BA Suite 4.8.x GA BA Suite 5.0.x GA BA Suite and PDI - Suite 5.1.x GA BA Suite and PDI - Suite 5.2.x GA BA Suite and PDI - Suite Vendor URL & Download: http://www.pentaho.com Product Description: "Pentaho Business Analytics, a suite of open source Business Intelligence (BI) products which provide data integration, OLAP services, reporting, dashboarding, data mining and ETL capabilities." (2) Vulnerability Details: -------------------------- The GetResource servlet, a vestige of the old platform UI, allows unauthenticated access to resources in the pentaho-solutions/system folder. Specifically vulnerable are properties files that may reveal passwords. The servlet allows access to files with the following extensions: .xsl .mondrian.xml .jpg .jpeg .gif .bmp .properties .jar The vulnerability allows unauthenticated access to properties files in the system solution which include properties files containing passwords. The offending code was heavily used in our previous version of our web UI but has since then been deprecated and is only being used in an old deprecated plugin (JPivot). For example, unauthenticated access to the defaultUser.spring.properties is allowed with the following URL: http://localhost:8080/pentaho/GetResource?resource=system/defaultUser.spring.properties (3) Advisory Timeline: ---------------------- 05/02/2015 - First Contact informing vendor of vulnerability 05/02/2015 - Response requesting details of vulnerability. Details sent 05/02/2015 - Vendor indicates issue is under investigation. 15/02/2015 - Vendor confirms patch ready and releases the patch 16/09/2015 - Public disclosure of vulnerability. (4)Solution: ------------ Apply the patches listed below to your Server at the following location. Download the appropriate .jar file for your version of the DI and BI Platform. Copy the .jar file to the WEB-INF/lib folder of each of your DI and BI Servers. Restart each of your servers Please note: SPA9-xxxx-4.5.0.11.jar works for both 4.3.x GA PDI - Suite and 4.5.x GA BI - Suite SPA9_xxxx-4.8.3.4-patch.jar works for both 4.4.x GA PDI - Suite and 4.8.x. GA BI - Suite SPA9_xxxx-5.x-patch.jar works for all 5.x Versions (5) Credits: ------------ Discovered by Gregory DRAPERI (6) References: ------------ https://support.pentaho.com/entries/78884125-Security-Vulnerability-Announcement-Feb-2015