CVE-2021-34427 Vulnerability Details

Record summary

CVE-2021-34427 has a selected CVSS score of 9.8 (critical); EIP currently links 1 repository PoC and 1 Nuclei template.

Description

In Eclipse BIRT versions 4.8.0 and earlier, an attacker can use query parameters to create a JSP file which is accessible from remote (current BIRT viewer dir) to inject JSP code into the running instance.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV: Listed · Dec 16, 2025 · VulnCheck
Reported exploitation: Observed · VulnCheck

Available material

Repository PoCs: 1
Nuclei templates: 1

Affected products and versions

Product	Source	Version range	Status
Eclipse BIRT Browse The Eclipse Foundation / Eclipse BIRT	CVE List	Through 4.8.0	affected
business_intelligence_and_reporting_tools Browse eclipse / business_intelligence_and_reporting_tools	VulnCheck	Version data not supplied

Proofs of concept

Repository PoCs

GitHubrt1252/CVE-2021-34427Repository PoCby rt12520Exploit2 files

4.3 KiB

GitHub

PoC details

Analysisdeepseek-v4-pro:cloud · 2026-08-07

Technical assessment

Python script that exploits CVE-2021-34427 in Eclipse BIRT by uploading a JSP webshell via a crafted GET request and then executing arbitrary OS commands through the webshell.

Backdoor review

No backdoor observed in reviewed code

The PoC script CVE-2021-34427.py implements a documented exploit for CVE-2021-34427 against Eclipse BIRT. It uploads a JSP webshell and executes a user-supplied command, which is the expected exploit behavior. No concealed backdoor, unrelated payload, or operator-directed harm is present.

ClassificationExploit

Model confidence98%

AuthenticationNot required

LanguagesPython

Target softwareEclipse BIRT

Attack typesRemote Code ExecutionWebshell Upload

Evidence & reasoningClassification basis · observed behavior · safety review

Technical evidence

Classification basis and observed behavior

Classification basis

The script actively exploits the vulnerability by uploading a JSP webshell and executing commands, which is the definition of an exploit. It does not merely detect or report the vulnerability.

CVE-2021-34427.py:4CVE-2021-34427.py:63-74CVE-2021-34427.py:82-94

Requirements

Target must be running a vulnerable Eclipse BIRT instance (version 4.8.0 or earlier) on Windows with Tomcat, accessible at the configured TARGET URL.CVE-2021-34427.py:5CVE-2021-34427.py:60-61
The BIRT viewer must have a report design file named 'test.rptdesign' accessible.CVE-2021-34427.py:85

Observed behavior

Generates a random filename with a .jsp extension.CVE-2021-34427.py:77-79
Sends a GET request to /reports/document with parameters __report, sample (containing JSP code), and __document set to './<name>/.' to bypass extension checks and write a JSP webshell.CVE-2021-34427.py:82-89
Sends a GET request to the uploaded JSP file with a 'cmd' parameter to execute an arbitrary OS command on the target server.CVE-2021-34427.py:92-94
Parses the response to extract and display command output, filtering out known BIRT document noise.CVE-2021-34427.py:45-57CVE-2021-34427.py:130

Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Exploit Mechanism: Payload withheldThe script drops a JSP webshell via a crafted GET request and then executes a user-provided command through it, matching the described CVE-2021-34427 exploit.CVE-2021-34427.py:63-74CVE-2021-34427.py:82-89CVE-2021-34427.py:92-94
Target Configuration: Payload withheldThe target URL is a placeholder requiring operator configuration; no hardcoded exfiltration endpoint is present.CVE-2021-34427.py:60

Review boundaries

What the analysis did not establish

The TARGET and BASE variables are hardcoded to placeholder values and must be modified by the user before execution.
The script is designed for Windows targets using cmd.exe; it may not work on other operating systems without modification.
The script assumes the presence of a 'test.rptdesign' report file on the target, which may not exist in all deployments.
Only the two text files (CVE-2021-34427.py and README.md) were reviewed; no binary files were present in the artifact.

Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Nuclei templates

ProjectDiscoveryCRITICALEclipse BIRT Viewer - Remote Code ExecutionCVSS 9.8

Eclipse BIRT versions 4.8.0 and earlier contain a JSP injection caused by query parameters, letting remote attackers create and access malicious JSP files in the viewer directory, exploit requires sending crafted query parameters.

Impact

Unauthenticated attackers can create and access malicious JSP files via JSP injection, achieving remote code execution and complete server compromise.

Remediation

Upgrade to Eclipse BIRT version 4.9.0 or later.

WeaknessesCWE-434

Authorsus3r777, Synacktiv

Template tagscvecve2021birtrcefile-uploadintrusivevulnvkev

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CPE: cpe:2.3:a:eclipse:business_intelligence_and_reporting_tools:*:*:*:*:*:*:*:*

Shodan: http.title:"eclipse birt home"

https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142 https://sec-consult.com/vulnerability-lab/advisory/remote-code-execution-bypass-eclipse-business-intelligence-reporting-birt/ https://nvd.nist.gov/vuln/detail/CVE-2021-34427

Source: ProjectDiscovery

References

packetstormsecurity.com

http://packetstormsecurity.com/files/170326/Eclipse-Business-Intelligence-Reporting-Tool-4.11.0-Remote-Code-Execution.html

20221220 SEC Consult SA-20221216-0 :: Remote code execution bypass in Eclipse Business Intelligence Reporting Tool (BiRT)mailing list

http://seclists.org/fulldisclosure/2022/Dec/30

bugs.eclipse.org

https://bugs.eclipse.org/bugs/show_bug.cgi?id=538142

nvd.nist.gov

https://nvd.nist.gov/vuln/detail/CVE-2021-34427