PT-2021-20644 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Published 2021-11-08 · Updated 2021-11-09 · CVE-2021-34685

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics versions through 9.1

Description: The issue allows an authenticated user to upload various files of different file types due to improper verification of uploaded user files. Specifically, uploading a .jsp. file is allowed, which can lead to remote code execution, even though a .jsp file is not allowed.

Recommendations: For Hitachi Vantara Pentaho Business Analytics versions through 9.1, consider restricting file uploads to only necessary file types and ensure proper verification of uploaded files to prevent remote code execution. As a temporary workaround, consider disabling the file upload feature in the UploadService until a proper fix is available.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2021-34685

Affected Products

Hitachi Vantara Pentaho Business Analytics Server

References · 5

• 🔥 http://packetstormsecurity.com/files/164775/Pentaho-Business-Analytics-Pentaho-Business-Server-9.1-Filename-Bypass.html · Exploit
• https://osv.dev/vulnerability/CVE-2021-34685 · Vendor Advisory
• https://hitachi.com/hirt/security/index.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-34685 · Security Note
• https://t.me/cibsecurity/31951 · Telegram Post