CVE-2022-43939 Hitachi Vantara Pentaho BA Server Authorization Bypass

CVE-2022-43939 is a critical security vulnerability identified in Hitachi Vantara’s Pentaho Business Analytics Server. This flaw stems from the improper handling of non-canonical URL paths during authorization decisions, allowing attackers to bypass security restrictions and gain unauthorized access to the system. ​

What is Vulnerable to CVE-2022-43939

The following versions of Pentaho Business Analytics Server are affected by CVE-2022-43939:​

• Versions before 9.4.0.1​
• Versions before 9.3.0.2​
• All 8.3.x versions​Red Hat Access+1trendmicro.com+1Red Hat Access+1

Organizations utilizing these versions should assess their exposure promptly. ​

Mitigation and Remediation for CVE-2022-43939

To mitigate the risks associated with CVE-2022-43939, consider the following actions:

• Upgrade: Update to Pentaho Business Analytics Server version 9.4.0.1 or later. ​

• Restrictive Authorization Filters: Define a more restrictive set of authorization filters in the security configuration to mitigate potential exploitation. ​NVD

Implementing these measures will help protect your systems from potential exploitation.​

Impact of Successful Exploitation of CVE-2022-43939

A successful exploitation of CVE-2022-43939 can have severe consequences, including:​

• Authentication Bypass: Attackers can access restricted areas of the application without proper authorization.​

• Remote Code Execution (RCE): When combined with other vulnerabilities, such as CVE-2022-43769, attackers can execute arbitrary code on the server, potentially leading to complete system compromise. ​

Given the critical nature of this vulnerability, immediate action is recommended to secure affected systems.​

Proof of Concept for CVE-2022-43939

A proof of concept (PoC) demonstrating the exploitation of CVE-2022-43939 has been developed and integrated into the Metasploit Framework. This PoC chains CVE-2022-43939 with CVE-2022-43769 to achieve unauthenticated remote code execution. ​feedly.com+1picussecurity.com+1feedly.com+1

For example, an attacker can exploit these vulnerabilities using a crafted URL to execute arbitrary commands on the server:​

This URL leverages the authorization bypass to access a restricted endpoint and injects a malicious payload that executes the notepad.exe application on the server.​Exploit Database+1Aura Infosec Research+1Exploit Database+1

Organizations are advised to apply the recommended updates and mitigations to protect against potential exploitation.