SpagoBI Command Injection Vulnerability Allowing Arbitrary Code Execution

A command injection vulnerability has been identified in SpagoBI version 3.5.1. This issue arises in the script input feature, where an authenticated user can execute arbitrary code on the server. The vulnerability is exploited by writing a Groovy script that executes operating system commands, potentially leading to unauthorized access or manipulation of the server.

Impact

Exploitation of this vulnerability allows authenticated users with script-writing privileges to execute arbitrary code on the server, potentially leading to a complete compromise of the affected system.

Reproduction

To reproduce this vulnerability, log into the SpagoBI web application with an account that has permission to write scripts. Navigate to the script insertion panel and select Groovy as the programming language. Insert a script that executes an OS command, such as one that sends a request to an external IP address. After testing the script execution, a reverse shell can be established.

Remediation

Users are advised to disable the script input feature and update to the latest version of SpagoBI.