Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery

An attacker can exploit this vulnerability by crafting malicious HTTP/HTTPS requests with manipulated Host headers. This allows them to trick the server into believing the request originates from a trusted source, effectively bypassing access controls and potentially gaining unauthorized access to sensitive data or functionality. The attacker could redirect requests to unintended destinations, potentially exfiltrating data or launching further attacks. This bypass could allow attackers to access internal resources normally protected by network segmentation or firewalls, significantly expanding the blast radius of a successful attack.

Organizations using Pentaho Business Analytics Server in environments with strict network segmentation or firewalls are particularly at risk. Legacy configurations that rely heavily on Host header validation for access control are also vulnerable. Shared hosting environments where multiple tenants share the same server infrastructure should be carefully assessed.

• linux / server: Use tcpdump or wireshark to monitor HTTP/HTTPS traffic and identify requests with unusual or unexpected Host headers. Examine access logs for patterns indicating Host header manipulation attempts.

ttcpdump -i any -A 'host header contains "malicious.example.com"'

• generic web: Use curl to test endpoint exposure with different Host headers. Check response headers for unexpected behavior.

curl -H "Host: malicious.example.com" https://your-pentaho-server/your-endpoint

1. 2025-02-19Disclosure

   disclosure

1. Reserviert2024-06-06
2. Veröffentlicht2025-02-19
3. Geändert2025-02-20
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-37359 is to upgrade Pentaho Business Analytics Server to version 9.3.0.9 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) or proxy to filter incoming requests and validate the Host header. Configure the WAF to reject requests with unexpected or malicious Host headers. Additionally, review and strengthen network segmentation to limit the potential impact of a successful exploitation. Carefully examine the server's configuration to ensure that it is not inadvertently allowing requests from untrusted sources.