CVE-2022-41561

What it actually does

The JNDI Data Sources component permits a privileged network attacker to supply a malicious JNDI reference that triggers remote code execution and spawns a reverse shell on the server.

Why it matters to the business

An attacker who already holds administrative credentials can seize full control of the reporting server, exposing or altering business reports and connected data sources.

How an attack unfolds

A privileged attacker authenticates to the JasperReports Server web interface, navigates to the JNDI Data Sources configuration, supplies a crafted JNDI lookup string pointing to an attacker-controlled server, triggers the lookup, and receives a reverse shell for further execution.

How to fix it

Upgrade TIBCO JasperReports Server to a version later than the affected releases (8.0.2 and 8.1.0 families) and restrict administrative interfaces to trusted networks only.

How to confirm the fix worked

Confirm the installed product version exceeds the affected releases, review JNDI configuration for unauthorized entries, and test that arbitrary JNDI lookups are rejected.

Typical attack path

1. Obtain administrative credentials and network access
2. Log into the JasperReports Server administration console
3. Create or modify a JNDI Data Source entry with a malicious reference
4. Trigger the data source lookup to execute the payload
5. Receive and interact with the resulting reverse shell

How to detect it

Inspect JasperReports Server logs for unexpected JNDI lookup strings, outbound connections to unknown hosts on non-standard ports, and new processes spawned from the application container.

What your security team should do

• Apply the latest vendor update as soon as it becomes available
• Limit administrative access to the JasperReports Server to a minimal set of trusted hosts
• Enable and review server logs for anomalous JNDI binding attempts
• Segment the reporting server from high-value internal networks