CVE-2022-43769
Description
Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2, including 8.3.x allow certain web services to set property values which contain Spring templates that are interpreted downstream.
Summary dbcve.org
This is a Server-Side Template Injection (SSTI) vulnerability in Hitachi Vantara Pentaho Business Analytics Server. Certain web services allow users to set property values containing Spring template syntax (e.g., #{...}, ${...}), which are then interpreted/processed by the Spring framework downstream, potentially leading to remote code execution.
Mitigation
Upgrade to Pentaho Business Analytics Server versions 9.4.0.1 or 9.3.0.2 or later. If immediate upgrading is not feasible, restrict network access to the vulnerable web services and consider deploying a WAF with rules to detect and block Spring template syntax in request parameters.