CVE-2022-43938
📋 TL;DR
This vulnerability allows attackers to execute arbitrary code through malicious Pentaho Reports (*.prpt files) due to inability to disable scripting capabilities. It affects Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x. System administrators cannot restrict the JVM script manager as intended.
💻 Affected Systems
- Hitachi Vantara Pentaho Business Analytics Server
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to complete system compromise, data theft, and lateral movement within the network.
Likely Case
Unauthorized code execution with the privileges of the Pentaho server process, potentially leading to data exfiltration or further exploitation.
If Mitigated
Limited impact if network segmentation and strict file upload controls prevent malicious report uploads.
🎯 Exploit Status
Exploitation requires ability to upload or create malicious .prpt report files, which typically requires some level of access to the Pentaho server.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 9.4.0.1 or 9.3.0.2
Restart Required: Yes
Instructions:
1. Download the patched version (9.4.0.1 or 9.3.0.2) from Hitachi Vantara. 2. Backup current installation and data. 3. Stop the Pentaho server. 4. Apply the update following vendor documentation. 5. Restart the server and verify functionality.
🔧 Temporary Workarounds
Restrict Report Uploads
allImplement strict controls on who can upload or create .prpt report files through application permissions and network controls.
Network Segmentation
allIsolate Pentaho servers from sensitive systems and restrict inbound access to only necessary users.
🧯 If You Can't Patch
- Implement strict file upload validation to reject suspicious .prpt files
- Monitor server logs for unusual report creation or execution activities
🔍 How to Verify
Check if Vulnerable:
Check the Pentaho server version in the administration console or by examining the server startup logs.Check Version:
Check the Pentaho administration web interface or examine the server logs for version information during startup.Verify Fix Applied:
Confirm the server version is 9.4.0.1, 9.3.0.2, or later after patching.📡 Detection & Monitoring
Log Indicators:
- Unusual .prpt file uploads or executions
- Errors related to script execution in report files
- Unexpected process creation from Pentaho server
Network Indicators:
- Unusual outbound connections from Pentaho server
- Traffic patterns suggesting data exfiltration
SIEM Query:
source="pentaho_server" AND (event="report_upload" OR event="script_execution") AND result="success" | stats count by user, file_name🔗 References
- https://support.pentaho.com/hc/en-us/articles/14454630725645--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43938-
- https://support.pentaho.com/hc/en-us/articles/14454630725645--Resolved-Pentaho-BA-Server-Improper-Neutralization-of-Directives-in-Statically-Saved-Code-Static-Code-Injection-Versions-before-9-4-0-1-and-9-3-0-2-including-8-3-x-Impacted-CVE-2022-43938-
