CVE-2021-41372
📋 TL;DR
This vulnerability allows attackers to upload malicious Power BI template files containing HTML with scripts. When victims access these HTML files, the scripts execute in their security context, potentially leading to privilege escalation if the victim has admin rights. It affects Power BI Report Server users who upload template files.
💻 Affected Systems
- Microsoft Power BI Report Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An attacker gains administrative control over the Power BI Report Server by exploiting an admin user's session, leading to full system compromise and data exfiltration.
Likely Case
Attackers steal session cookies or perform actions on behalf of authenticated users, potentially accessing sensitive reports or modifying data.
If Mitigated
With proper input sanitization and CSRF protections, the attack fails to execute malicious scripts or upload unauthorized files.
🎯 Exploit Status
Exploitation requires combining XSS and CSRF, and victim interaction with malicious files.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply the security update from Microsoft's October 2021 Patch Tuesday
Vendor Advisory: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-41372
Restart Required: Yes
Instructions:
1. Download the security update from Microsoft Update Catalog. 2. Install the update on the Power BI Report Server. 3. Restart the server as required.
🔧 Temporary Workarounds
Restrict File Uploads
windowsLimit file uploads to trusted users and monitor for suspicious .pbix files.
Implement CSRF Tokens
allAdd CSRF protection to file upload endpoints to prevent unauthorized uploads.
🧯 If You Can't Patch
- Disable file upload functionality for untrusted users.
- Implement web application firewall (WAF) rules to block malicious HTML content in uploads.
🔍 How to Verify
Check if Vulnerable:
Check Power BI Report Server version; if prior to October 2021 security update, it is vulnerable.Check Version:
Check server version via Power BI Report Server configuration manager or PowerShell: Get-PowerBIReportServerVersionVerify Fix Applied:
Verify the server version matches or exceeds the patched version and test file upload sanitization.📡 Detection & Monitoring
Log Indicators:
- Unusual .pbix file uploads from unexpected IPs
- Access logs showing direct HTML file accesses from uploaded templates
Network Indicators:
- HTTP requests uploading .pbix files with embedded HTML scripts
- Outbound connections triggered by accessed HTML files
SIEM Query:
source="PowerBI_Logs" AND (file_upload="*.pbix" OR url="*.html") AND user_agent="suspicious"