Pentaho 5.2.x BA Suite / PDI Information Disclosure

2015.09.20
Risk: Low
Local: No
Remote: Yes
CWE: CWE-287


CVSS Base Score: 5/10
Impact Subscore: 2.9/10
Exploitability Subscore: 10/10
Exploit range: Remote
Attack complexity: Low
Authentication: No required
Confidentiality impact: Partial
Integrity impact: None
Availability impact: None

Exploit Title: Improper authentication allows unauthenticated access to configuration files Product: Pentaho GA PDI & Pentaho GA BA Vulnerable Versions: 5.2.x GA BA Suite and PDI - Suite and previous versions Tested Version: 5.2.x GA BA Suite and PDI - Suite Advisory Publication: 15/02/2015 Latest Update: 15/02/2015 Vulnerability Type: Improper Authentication [CWE-287] CVE Reference: CVE-2015-6940 Credit: Gregory DRAPERI Advisory Details: (1) Vendor & Product Description -------------------------------- Vendor: PENTAHO Product & Version: 4.3.x GA PDI - Suite 4.4.x GA PDI - Suite 4.5.x GA BA Suite 4.8.x GA BA Suite 5.0.x GA BA Suite and PDI - Suite 5.1.x GA BA Suite and PDI - Suite 5.2.x GA BA Suite and PDI - Suite Vendor URL & Download: http://www.pentaho.com Product Description: "Pentaho Business Analytics, a suite of open source Business Intelligence (BI) products which provide data integration, OLAP services, reporting, dashboarding, data mining and ETL capabilities." (2) Vulnerability Details: -------------------------- The GetResource servlet, a vestige of the old platform UI, allows unauthenticated access to resources in the pentaho-solutions/system folder. Specifically vulnerable are properties files that may reveal passwords. The servlet allows access to files with the following extensions: .xsl .mondrian.xml .jpg .jpeg .gif .bmp .properties .jar The vulnerability allows unauthenticated access to properties files in the system solution which include properties files containing passwords. The offending code was heavily used in our previous version of our web UI but has since then been deprecated and is only being used in an old deprecated plugin (JPivot). For example, unauthenticated access to the defaultUser.spring.properties is allowed with the following URL: http://localhost:8080/pentaho/GetResource?resource=system/defaultUser.spring.properties (3) Advisory Timeline: ---------------------- 05/02/2015 - First Contact informing vendor of vulnerability 05/02/2015 - Response requesting details of vulnerability. Details sent 05/02/2015 - Vendor indicates issue is under investigation. 15/02/2015 - Vendor confirms patch ready and releases the patch 16/09/2015 - Public disclosure of vulnerability. (4)Solution: ------------ Apply the patches listed below to your Server at the following location. Download the appropriate .jar file for your version of the DI and BI Platform. Copy the .jar file to the WEB-INF/lib folder of each of your DI and BI Servers. Restart each of your servers Please note: SPA9-xxxx-4.5.0.11.jar works for both 4.3.x GA PDI - Suite and 4.5.x GA BI - Suite SPA9_xxxx-4.8.3.4-patch.jar works for both 4.4.x GA PDI - Suite and 4.8.x. GA BI - Suite SPA9_xxxx-5.x-patch.jar works for all 5.x Versions (5) Credits: ------------ Discovered by Gregory DRAPERI (6) References: ------------ https://support.pentaho.com/entries/78884125-Security-Vulnerability-Announcement-Feb-2015

References:

https://support.pentaho.com/entries/78884125-Security-Vulnerability-Announcement-Feb-2015


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top