Description
Pentaho Business Analytics是一款使您能够安全地访问、集成、操作、可视化和分析大数据资产的业务分析平台。Pentaho 业务分析平台在/require.js接口处存在代码执行漏洞。攻击者可通过该漏洞在服务器端任意执行代码，写入后门，获取服务器权限，进而控制整个web服务器。
Pentaho业务分析平台 /require.js 代码执行漏洞（CVE-2022-43769）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/cve-2022-43769
https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769
https://www.exploit-db.com/exploits/51350
https://attackerkb.com/topics/hy6nWcCo30/cve-2022-43769
https://pentest-tools.com/vulnerabilities-exploits/hitachi-pentaho-business-analytics-server-remote-code-execution_2038
https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-43769.yaml
https://www.rapid7.com/db/modules/exploit/multi/http/pentaho_business_server_authbypass_and_ssti/
https://www.cve.org/CVERecord?id=CVE-2022-43769