CVE-2022-43939
Hitachi Vantara Pentaho BA Server Authorization Bypass Vulnerability
Description
CVE-2022-43939 is a high-severity authentication bypass vulnerability in Hitachi Vantara Pentaho Business Analytics (BA) Server that allows unauthenticated attackers to circumvent security restrictions using non-canonical URL paths. The vulnerability exists because the server's authorization logic can be bypassed by manipulating the URL structure, enabling access to protected resources and endpoints without valid credentials. With a CVSS v3.1 base score of 8.6, the flaw affects Pentaho BA Server versions prior to 9.4.0.1 and 9.3.0.2, including all 8.3.x releases. CISA has added CVE-2022-43939 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 24, 2025, and the EPSS score of 93.38% at the 99.8th percentile confirms near-certain exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:HOpen in CalculatorCWEs
Affected Products
| Vendor | Product | Version |
|---|---|---|
| hitachi | vantara pentaho business analytics server | < 9.3.0.2; 9.4.0.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/172296/Pentaho-Business-Server-Authentication-Bypass-SSTI-Code-Execution.html(Exploit)
- https://support.pentaho.com/hc/en-us/articles/14455394120333--Resolved-Pentaho-BA-Server-Use-of-Non-Canonical-URL-Paths-for-Authorization-Decisions-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43939-(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-43939(US Government Resource)
Weakness Type
CWE-706: Use of Incorrectly-Resolved Name or Reference
CVE-2022-43939 falls under the category of improperly resolved names or references, specifically involving non-canonical URL paths that bypass authorization decisions. The Pentaho BA Server uses URL paths to determine whether a request should be allowed or denied, but fails to normalize or canonicalize these paths before making authorization decisions. Attackers can craft non-standard URL representations (such as path traversal sequences, double encoding, or alternate path separators) that reference the same resources as protected URLs but do not match the authorization rules. This class of vulnerability is related to CWE-863 (Incorrect Authorization) where the server makes flawed access control decisions based on manipulated input.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2022-43939 represents a critical security boundary failure in Pentaho BA Server's access control system. The vulnerability is network-exploitable (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N). Confidentiality (Low): The authentication bypass itself provides access to protected endpoints and resources, exposing server configuration, user information, and potentially partial business intelligence data. The direct confidentiality impact is rated low because the bypass alone may not expose all sensitive data. Integrity (Low): Unauthorized access to protected endpoints allows partial modification of server-side resources, though the extent depends on the specific endpoints accessible through the bypass. Availability (High): The authentication bypass can be leveraged to access administrative functions that may disrupt server operations, delete resources, or cause service denial. The most critical risk arises when CVE-2022-43939 is chained with CVE-2022-43769, a server-side template injection vulnerability in the same product. Together, they enable fully unauthenticated remote code execution — the authentication bypass provides the entry point, and the SSTI vulnerability delivers the code execution payload. The EPSS score of 93.38% at the 99.8th percentile reflects this devastating combination, making exploitation virtually certain for exposed instances.
Exploit Maturity
CVE-2022-43939 exhibits maximum exploit maturity with publicly available exploit code and near-certain exploitation probability. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, mandating remediation by March 24, 2025. Public exploit code is available through Packet Storm Security, which documents the combined authentication bypass and code execution attack chain. The EPSS score of 93.38% at the 99.8th percentile confirms near-certain exploitation activity. The vulnerability is commonly exploited in conjunction with CVE-2022-43769 (SSTI), creating a particularly dangerous attack chain: CVE-2022-43939 bypasses authentication through non-canonical URLs, and CVE-2022-43769 then enables arbitrary code execution through Spring template injection. Hitachi Vantara has published a vendor advisory with remediation guidance.
Remediation
-
Upgrade Pentaho BA Server immediately. Update to Pentaho BA Server version 9.4.0.1 or 9.3.0.2 or later, which implement proper URL canonicalization before authorization decisions. Download the updates from Hitachi Vantara support.
-
Patch CVE-2022-43769 simultaneously. The SSTI vulnerability CVE-2022-43769 is routinely chained with CVE-2022-43939 for unauthenticated remote code execution. Both must be addressed together by upgrading to the same patched versions (9.4.0.1 or 9.3.0.2).
-
Deploy a reverse proxy with URL normalization. Place Pentaho BA Server behind a reverse proxy (such as nginx or Apache) configured to normalize and canonicalize URL paths before forwarding requests. This provides defense in depth against URL manipulation attacks.
-
Restrict network access to Pentaho BA Server. Limit access to the Pentaho web interface to trusted internal networks and VPN connections only. Block direct internet access to the Pentaho server through firewall rules. Implement IP-based access controls as an additional layer.
-
Review access logs for exploitation indicators. Search web server and application logs for non-canonical URL patterns including double-encoded characters, path traversal sequences, and unusual URL structures targeting protected endpoints. Look for patterns consistent with the published exploit chain that combines authentication bypass with template injection.
Technical Details
CVE-2022-43939 is an authentication bypass vulnerability in Hitachi Vantara Pentaho Business Analytics Server caused by the use of non-canonical URL paths for authorization decisions. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H reflects unauthenticated network access with low complexity and significant availability impact. The vulnerability exists in the server's URL-based authorization mechanism, which compares incoming request URLs against a set of access control rules to determine whether the request should be allowed or denied. However, the comparison is performed against the raw URL path without first normalizing it to its canonical form. URL canonicalization involves resolving path elements such as dot-dot sequences (../), double slashes (//), URL encoding (%2f), and other non-standard representations to their standard form. By crafting requests with non-canonical URL paths that resolve to the same server-side resources as protected URLs but do not match the authorization rule patterns, an attacker can access endpoints that should require authentication. The severity increases dramatically when combined with CVE-2022-43769: the attacker uses non-canonical URLs to bypass authentication and reach web service endpoints that allow setting property values containing Spring Expression Language (SpEL) templates, achieving unauthenticated remote code execution on the Pentaho server.
Frequently Asked Questions
Is CVE-2022-43939 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2022-43939 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 24, 2025. Public exploit code is available that chains this authentication bypass with CVE-2022-43769 for unauthenticated remote code execution.
What versions of Pentaho BA Server are affected?
CVE-2022-43939 affects Hitachi Vantara Pentaho BA Server versions prior to 9.4.0.1 and prior to 9.3.0.2, including all 8.3.x versions. Organizations must upgrade to version 9.4.0.1 or 9.3.0.2 to resolve the vulnerability.
How does the authentication bypass work?
The Pentaho BA Server uses URL paths to make authorization decisions but does not canonicalize the URLs before comparison. Attackers craft non-canonical URL representations (using techniques like double encoding or path traversal) that access the same protected resources but do not match the server's authorization rules, effectively bypassing authentication.
How does CVE-2022-43939 relate to CVE-2022-43769?
The two vulnerabilities form a devastating attack chain. CVE-2022-43939 provides unauthenticated access to protected endpoints through non-canonical URL manipulation. CVE-2022-43769 then enables arbitrary code execution through Spring template injection on those now-accessible endpoints. Together, they allow a completely unauthenticated attacker to execute arbitrary commands on the Pentaho server.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.