PT-2023-2084 · Hitachi Vantara · Hitachi Vantara Pentaho Business Analytics Server

Published 2023-04-03 · Updated 2025-03-13 · CVE-2022-43769

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.4.0.1 and 9.3.0.2, including 8.3.x

Description The issue is related to the incorrect neutralization of special elements in output, which can allow a remote attacker to execute arbitrary commands by injecting specially crafted Spring templates. Certain web services in the affected software allow setting property values that contain Spring templates, which are interpreted downstream.

Recommendations For versions prior to 9.4.0.1, update to version 9.4.0.1 or later. For versions prior to 9.3.0.2, update to version 9.3.0.2 or later. As a temporary workaround, consider restricting access to web services that allow setting property values with Spring templates until a patch is available.

Exploit

Fix

Special Elements Injection

Code Injection

Weakness Enumeration

CWE-74

CWE-94

Related Identifiers

BDU:2023-01817

CVE-2022-43769

Affected Products

Hitachi Vantara Pentaho Business Analytics Server

References · 18

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/pentaho_business_server_authbypass_and_ssti.rb · Exploit
• 🔥 http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html · Exploit
• 🔥 https://exploit-db.com/exploits/51350 · Exploit
• https://bdu.fstec.ru/vul/2023-01817 · Security Note
• https://osv.dev/vulnerability/CVE-2022-43769 · Vendor Advisory
• https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769- · Vendor Advisory
• https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-43769 · Security Note
• https://reddit.com/r/pwnhub/comments/1j2rbqo/cisa_warns_of_newly_exploited_vulnerabilities · Reddit Post
• https://t.me/cvenotify/114735 · Telegram Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43769 · Note
• https://twitter.com/ScyScan/status/1896955390329561586 · Twitter Post
• https://t.me/cybersecuritytechnologies/8078 · Telegram Post
• https://t.me/cvenotify/113283 · Telegram Post
• https://twitter.com/transilienceai/status/1899286353185038364 · Twitter Post