CVE-2022-43769: Hitachi Vantara Pentaho BA Server Spring Template Injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityThe flaw is in CISA KEV with a near-maximum EPSS score and public exploit code, and it enables code execution on an internet-facing analytics server.

What it is

Hitachi Vantara Pentaho Business Analytics Server before 9.4.0.1 and 9.3.0.2, including 8.3.x, allows certain web services to set property values containing Spring templates that are interpreted downstream. This is a server-side template injection (CWE-94 code injection) that can lead to code execution on the server. It matters because the product is widely deployed for analytics and the flaw is now in CISA's Known Exploited Vulnerabilities catalog.

Impact

An attacker with high privileges can inject and execute code on the Pentaho BA Server, gaining full control of confidentiality, integrity and availability of the affected system. Successful exploitation can lead to remote code execution in the server's context.

Attack surface

Reached over the network via web services that accept property values; the CVSS vector indicates high privileges are required (PR:H) and no user interaction (UI:N). Authentication is needed, but the referenced exploit title mentions an authentication bypass, so the practical barrier may be lower than the vector alone suggests.

Exploitation

CISA added this to the KEV catalog on 2025-03-03 with a 2025-03-24 remediation due date, and EPSS is 0.9767 (99.9th percentile), indicating active exploitation is expected. Public exploit code is referenced on Packet Storm.

What to do

• Upgrade Pentaho Business Analytics Server to 9.4.0.1 or 9.3.0.2 (or later) per the vendor advisory.
• If immediate upgrade is not possible, apply the vendor's documented mitigations or restrict access to the affected web services.
• Follow BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are unavailable.
• Restrict network access to Pentaho BA Server management and web service endpoints to trusted hosts only.
• Monitor for and rotate any credentials or secrets that may have been exposed on affected servers.

Detection

• Review Pentaho BA Server logs for unusual property values containing Spring template syntax (e.g., ${...}, #{...}) submitted to web services.
• Hunt for unexpected child processes spawned by the Pentaho Java process, especially shells or scripting interpreters.
• Monitor for outbound network connections from the Pentaho server to unfamiliar hosts that could indicate post-exploitation activity.
• Audit authentication logs for anomalous or bypassed logins preceding suspicious web service calls.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.