CVE-2022-43769
Hitachi Vantara Pentaho BA Server Special Element Injection Vulnerability
Description
CVE-2022-43769 is a high-severity server-side template injection (SSTI) vulnerability in Hitachi Vantara Pentaho Business Analytics (BA) Server that allows authenticated remote attackers to execute arbitrary code. The vulnerability exists because certain web services allow property values to be set that contain Spring templates, which are then interpreted by the server downstream. With a CVSS v3.1 base score of 8.8, the flaw affects Pentaho BA Server versions prior to 9.4.0.1 and 9.3.0.2, including all 8.3.x releases. CISA has added CVE-2022-43769 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 24, 2025, and the EPSS score of 93.98% at the 99.9th percentile confirms near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| hitachi | vantara pentaho business analytics server | >= 8.3.0.0, < 9.3.0.2; 9.4.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html(Exploit)
- https://support.pentaho.com/hc/en-us/articles/14455561548301--Resolved-Pentaho-BA-Server-Failure-to-Sanitize-Special-Elements-into-a-Different-Plane-Special-Element-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43769-(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43769(US Government Resource)
Weakness Type
CWE-94: Improper Control of Generation of Code (Code Injection)
CVE-2022-43769 is a code injection vulnerability where user-controlled input is processed as executable Spring template expressions. Server-Side Template Injection (SSTI) occurs when an application embeds user input into server-side templates without proper sanitization, allowing attackers to inject template directives that are executed by the template engine. In the Pentaho BA Server, property values set through web services are passed to the Spring Expression Language (SpEL) interpreter, enabling authenticated attackers to execute arbitrary Java code on the server.
Learn more: CWE-94 — Improper Control of Generation of Code (Code Injection)
Impact Analysis
CVE-2022-43769 poses a critical risk to organizations running Hitachi Vantara Pentaho BA Server for business intelligence and analytics. The vulnerability is network-exploitable (AV:N) with low attack complexity (AC:L), requiring only low-level authentication (PR:L) and no user interaction (UI:N). Confidentiality (High): Successful exploitation enables the attacker to execute arbitrary Java code on the server, providing access to all data stored in and processed by the Pentaho platform. This typically includes sensitive business intelligence data, database connection credentials, ETL configurations, and reports containing confidential business metrics. Integrity (High): Code execution allows the attacker to modify reports, alter data transformation processes, inject malicious content into dashboards, and tamper with the integrity of business analytics used for decision-making. Availability (High): The attacker can disrupt the Pentaho server, delete data repositories, corrupt transformation jobs, or use the compromised server to launch attacks against connected database systems. The EPSS score of 93.98% at the 99.9th percentile places this among the most likely-to-be-exploited vulnerabilities tracked, though the ransomware association is currently listed as unknown.
Exploit Maturity
CVE-2022-43769 exhibits maximum exploit maturity with publicly available exploit code. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, mandating remediation by March 24, 2025. Public exploit code is available through Packet Storm Security, which documents a combined authentication bypass and SSTI code execution attack chain targeting Pentaho BA Server. The EPSS score of 93.98% at the 99.9th percentile confirms near-certain exploitation activity. This vulnerability is frequently chained with CVE-2022-43939, an authentication bypass in the same product, allowing initially unauthenticated attackers to first bypass authentication and then exploit the SSTI vulnerability for full remote code execution. Hitachi Vantara has published a vendor advisory with remediation details.
Remediation
-
Upgrade Pentaho BA Server immediately. Update to Pentaho BA Server version 9.4.0.1 or 9.3.0.2 or later, which resolve the template injection vulnerability. Download the updates from Hitachi Vantara support.
-
Address CVE-2022-43939 simultaneously. The authentication bypass vulnerability CVE-2022-43939 is commonly chained with CVE-2022-43769. Both must be patched together to prevent the combined unauthenticated RCE attack chain. The same updated versions (9.4.0.1 and 9.3.0.2) address both vulnerabilities.
-
Restrict network access to Pentaho BA Server. Limit access to the Pentaho web interface to trusted internal networks only. Deploy a web application firewall (WAF) with rules to detect and block Spring Expression Language (SpEL) injection patterns in HTTP request parameters.
-
Audit Pentaho user accounts and permissions. Review all authenticated users and their privilege levels. Remove unnecessary accounts and enforce strong authentication policies. Since the vulnerability requires authenticated access (when not chained with CVE-2022-43939), reducing the number of valid accounts limits the attack surface.
-
Conduct forensic investigation on Pentaho servers. Review application logs and web server access logs for indicators of exploitation, including unusual property value modifications, SpEL expression patterns in request parameters, and unexpected process execution. Check for backdoors, web shells, and unauthorized data access.
Technical Details
CVE-2022-43769 is a Server-Side Template Injection (SSTI) vulnerability in Hitachi Vantara Pentaho Business Analytics Server. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H reflects network accessibility with low authenticated access and maximum impact across all three security objectives. The vulnerability exists in web services that allow users to set property values for server-side objects. These property values are passed through the Spring Framework's template processing pipeline, where they are interpreted as Spring Expression Language (SpEL) expressions. SpEL is a powerful expression language that supports method invocation, object construction, and access to the Java Runtime, making it equivalent to arbitrary Java code execution. An authenticated attacker can craft property values containing malicious SpEL expressions such as T(java.lang.Runtime).getRuntime().exec('command'), which the server evaluates during template processing. The resulting code execution occurs with the privileges of the Pentaho application server process, typically running as a service account with access to databases, file systems, and network resources. The attack is particularly severe when chained with CVE-2022-43939, which allows bypassing authentication entirely by using non-canonical URL paths that circumvent the authorization logic, enabling unauthenticated remote code execution.
Frequently Asked Questions
Is CVE-2022-43769 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2022-43769 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 24, 2025. Public exploit code is available, and the EPSS score of 93.98% at the 99.9th percentile confirms near-certain exploitation activity.
What versions of Pentaho BA Server are affected?
CVE-2022-43769 affects Hitachi Vantara Pentaho BA Server versions prior to 9.4.0.1 and prior to 9.3.0.2, including all 8.3.x versions. Organizations running any of these versions should upgrade immediately.
Can CVE-2022-43769 be exploited without authentication?
CVE-2022-43769 itself requires low-level authentication (PR:L). However, it is commonly chained with CVE-2022-43939, an authentication bypass vulnerability in the same product. Together, these vulnerabilities enable fully unauthenticated remote code execution against Pentaho BA Server.
How does the Server-Side Template Injection work?
The vulnerability allows attackers to inject Spring Expression Language (SpEL) expressions through property values in web service requests. The Pentaho server evaluates these expressions during template processing, executing the attacker's Java code with the server's privileges. This provides full control over the Pentaho application and its connected resources.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.