# Exploiting Hardcoded Keys to achieve RCE in Yellowfin BI

Hardcoded RSA/AES/JWT keys in Yellowfin BI enable pre-auth session forgery, privilege escalation, and post-auth JNDI injection leading to RCE.

- Payout: Research
- Severity: critical
- Program: Yellowfin BI
- Credited: Assetnote
- Disclosed: 2024-01-03
- CVE: CVE-2022-47884, CVE-2022-47885, CVE-2022-47882, CVE-2022-47883
- Write-up quality: 8/10
- Original: https://www.assetnote.io/resources/research/exploiting-hardcoded-keys-to-achieve-rce-in-yellowfin-bi
- Library page: https://bugbountylibrary.com/r/blog%3Aassetnote-io-resources-research-exploiting-hardcoded-keys-to-achieve-rce-in-yellowfin-bi
- Tags: domain:web impact:ato impact:rce kind:research platform:research sev:critical tech:java technique:chained technique:source-review vuln:auth-bypass vuln:privilege-escalation vuln:rce

**Target:** Java monolith BI web application (StoryBodyAction, JsAPI servlet, REST JWT, datasource connector)
**Root cause:** Authentication-related crypto (RSA signing key, AES cookie key, JWT secret) is hardcoded in the shipped source, so attackers can forge signatures, cookies, and tokens; post-auth datasource connectors allow JNDI injection.
**Steps:**
1. Grep source for `session.setAttribute("SessionData"` to enumerate login logic.
2. StoryBodyAction: sign `storyUUID + "\n" + ts` with hardcoded RSA private key (SHA512withRSA), base64+URL-encode as `s`, request `/StoryBody.i4?storyUUID=..&s=..&ts=..&ipPerson=..&ipOrg=..`.
3. JsAPI: AES-encrypt target user id with hardcoded key, set as `EXTAPI-IPID` cookie.
4. REST: forge JWT with hardcoded secret using a valid refresh token id from `/api/refresh-tokens`.
5. Post-auth: configure a datasource pointing to attacker JDBC/JNDI endpoint with forceString gadget to execute commands.
**How found:** Mapped pre-auth routes, found nothing exploitable, but noticed many hardcoded keys in auth code. Searched for the `session.setAttribute("SessionData", ...)` pattern to enumerate all login implementations, then audited each for forgeable trust checks.
**Exploitation:** Forge a valid session via hardcoded RSA signature (or AES cookie / JWT), then use the authenticated datasource configuration feature to trigger JNDI lookup to an attacker-controlled LDAP/RMI server, loading a forceString gadget that executes arbitrary commands on the Yellowfin server.
**Escalation:** Pre-auth bypass -> authenticated access -> datasource JNDI injection -> RCE.
**Insight:** Grep Java monoliths for the session-set pattern to enumerate every login path, then check each signature/cookie/token verification for embedded keys; also treat any authenticated 'connect to datasource' feature as a JNDI/JDBC injection candidate.