Pentaho BA Server: Exploited Auth Bypass and Template RCE

What to do

1. Inventory every Pentaho Business Analytics Server, including Community Edition installs and old reporting boxes, and record the exact build.
2. Upgrade anything before 9.3.0.2 or on 9.4.0.0 to a fixed, currently supported release.
3. Take the Pentaho web interface off the internet; allow it only from analyst networks or a VPN.
4. Rotate the datasource, LDAP and service credentials stored on any server that was exposed while unpatched.
5. Rebuild a server outright if the hunt below finds anything, rather than cleaning it in place.

How to check if you are affected or compromised

• Search Tomcat or proxy access logs for unauthenticated requests to /pentaho/api/ldap/config/ paths, especially with require.js in the path.
• Check for shells, downloaders or outbound connections spawned by the account the Pentaho Tomcat process runs as.
• Look for JSP or other files under the Pentaho webapps directory that nobody deployed.
• Compare source IPs in your logs against threat-intel feeds that tag Pentaho exploitation, such as GreyNoise.

What happened#

Pentaho Business Analytics Server is a Java business intelligence platform from Hitachi Vantara. In October 2022, Harry Withington of Aura Information Security reported eight flaws in it. Hitachi Vantara released patches on March 31, 2023, and Aura published its write-up on April 4. Two of the bugs are now in CISA's catalog:

• CVE-2022-43939: per the CVE record, security restrictions that use non-canonical URLs "can be circumvented." Aura traced it to a Spring Security rule that granted anonymous access to any path ending in a require.js-style name. The CNA scores it 8.6. NVD scores it 9.8.
• CVE-2022-43769: per the CVE record, certain web services let a caller set property values containing Spring templates that are "interpreted downstream." Aura found it in the admin-only LDAP configuration API, where it leads to command execution. The CNA scores it 8.8.

On its own, the second bug needs an admin session. Together they give unauthenticated code execution as the user running the server. Rapid7 published a Metasploit module for the chain, so working exploit code is public.

Who is affected#

All versions before 9.3.0.2, including 8.3.x, plus 9.4.0.0. Fixed builds are 9.3.0.2 and 9.4.0.1. Aura's advice was 9.3.0.3 or 9.4.0.1, and it noted that it had not validated the patches. The CVE records do not distinguish Enterprise and Community editions, so treat both as affected.

Do you really need to act?#

Only if a server is still on an old build, but those are common. BI servers often get installed for one project and then forgotten. They also hold database credentials for every datasource they report on. GreyNoise saw exploitation of both CVEs from 15 malicious IPs between December 6, 2024 and February 28, 2025. CISA added both to KEV on March 3, 2025. FortiGuard reported attack attempts on more than 500 devices. Nobody has named the actors as of Oct 23, 2026. For patched, internal-only servers this needs no action. For an old server that faces the internet, it is urgent.

What to do now#

1. Find every Pentaho server, including Community Edition installs, and record its exact build from the About dialog or the install directory name.
2. Upgrade anything below 9.3.0.2, or on 9.4.0.0, to a fixed and currently supported release.
3. Restrict the web interface to analyst networks or a VPN.
4. Rotate the datasource, LDAP and service credentials on any server that was exposed while unpatched.

How to tell if you were hit#

Search Tomcat or reverse-proxy logs for requests to the LDAP configuration API that came without a session or from unknown addresses, for example grep -E '/pentaho/api/ldap/config/.*require' access*.log. Look for shells, downloaders or outbound connections started by the account that runs Pentaho's Tomcat. Check the webapps tree for JSP files nobody deployed. If you find any of these, rebuild the server and rotate everything it could reach.

Timeline#

• Oct 25, 2022 — Aura discloses the flaws to Hitachi Vantara.
• Mar 31, 2023 — Hitachi Vantara releases patches.
• Apr 3, 2023 — Both CVEs are published.
• Apr 4, 2023 — Aura publishes its research.
• Dec 6, 2024 — GreyNoise first sees exploitation.
• Mar 3, 2025 — CISA adds both CVEs to KEV (due Mar 24).

Vulnerability records

• CVE-2022-43939 · KEV 2025-03-03 · Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2, including 8.3.x contain security restrictions using non-canonical URLs…
• CVE-2022-43769 · KEV 2025-03-03 · Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Aura Information Security — Pentah0wnage: Pre-Auth RCE in Pentaho Business Analytics Server research.aurainfosec.io
2. CVE record — CVE-2022-43939 cve.org
3. CVE record — CVE-2022-43769 cve.org
4. NVD — CVE-2022-43939 nvd.nist.gov
5. CISA — Known Exploited Vulnerabilities: CVE-2022-43939 cisa.gov
6. GreyNoise — GreyNoise Observes Exploitation of Three Newly Added KEV Vulnerabilities greynoise.io
7. FortiGuard Labs — Threat Signal: Hitachi Vantara Pentaho BA Server Vulnerabilities fortiguard.com
8. Rapid7 — Metasploit module: Pentaho Business Server Auth Bypass and SSTI rapid7.com