Executive brief
Smartbi is a business intelligence platform that integrates, analyzes, and visualizes data for enterprise decision-making. Versions 8, 9, and 10 contain a critical flaw in the request handling logic that allows unauthenticated attackers to bypass login controls and execute arbitrary code on the server, potentially leading to complete system compromise and data theft.
Technical details
The vulnerability exists in the RMIServlet request handler, which fails to properly validate authentication before processing RPC-style method invocations. An attacker can craft malicious HTTP requests to the /smartbi/vision/RMIServlet endpoint with specially encoded parameters that bypass the CheckIsLoggedFilter authentication check. By invoking certain UserService methods (e.g., isLogged, checkVersion) that are whitelisted but improperly validated, an attacker can gain an authenticated session without credentials. This authentication bypass can then be chained to execute arbitrary methods or upload malicious files, resulting in remote code execution with the privileges of the Smartbi application server.
Affected products
- Smartbi Smartbi V8 (certain versions), V9 (all versions), V10 (all versions)
Timeline
- 2023-07: disclosed: Vendor released fix in July 2023
- 2024-03-01: exploited: Observed in active exploitation and tracking in wild; 1Day analysis published