Pentaho BA Server: Exploited Auth Bypass and Template RCE
Fixed since March 2023, with public exploit code and exploitation seen since late 2024; confirm every Pentaho server is on a fixed build and hunt on any that sat exposed on an old one.
Must act: Anyone running Pentaho Business Analytics Server before 9.3.0.2, or 9.4.0.0, especially where the web interface is reachable from the internet.
Can relax: Teams on 9.3.0.2 or later, or 9.4.0.1 or later, whose servers are only reachable from internal analyst networks and show no signs of past compromise.
- Inventory every Pentaho Business Analytics Server, including Community Edition installs and old reporting boxes, and record the exact build.
- Upgrade anything before 9.3.0.2 or on 9.4.0.0 to a fixed, currently supported release.
- Take the Pentaho web interface off the internet; allow it only from analyst networks or a VPN.