^{CVE-2022-3960:}Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') in Hitachi Vantara Pentaho Business Analytics Server via the Community Dashboard Editor plugin, affecting versions prior to 9.4.0.1 and 9.3.0.2 (including 8.3.x).

Hitachi Vantara Pentaho Business Analytics Server versions before 9.4.0.1 and 9.3.0.2 (including 8.3.x) are vulnerable to code injection through the Community Dashboard Editor (CDE) plugin due to improper neutralization of directives in statically saved code. In these releases, the scripting capabilities of the CDE plugin cannot be disabled by a system administrator, enabling an attacker to craft or save scripts that are executed within dashboards. The vulnerability can be exploited remotely over the network with low privileges and requires no user interaction. It is categorized as CWE-96 (Improper Neutralization of Directives in Statically Saved Code) and aligns with CAPEC-242 Code Injection. The CVSS v3.1 base score is 6.3 (Medium), with low impact on confidentiality, integrity, and availability.

Overview

This vulnerability affects the Community Dashboard Editor plugin in Hitachi Vantara Pentaho Business Analytics Server prior to versions 9.4.0.1 and 9.3.0.2 (including 8.3.x). The root cause is improper neutralization of directives in statically saved code, enabling static code injection via the CDE scripting environment. Because the CDE scripting capabilities cannot be disabled in these versions, an attacker with network access and low privileges can potentially inject and execute malicious scripts without any user interaction, impacting the integrity and availability of dashboards and potentially broader server behavior. The issue is identified under CWE-96 and is associated with CAPEC-242 Code Injection.

Remediation

• Upgrade to fixed versions: Move to Pentaho BA Server 9.4.0.1 or later, or 9.3.0.2 for the 9.3 line (or newer releases that contain the patch). Verify with Hitachi Vantara for the latest recommended version.
• If immediate upgrade isn’t possible: apply any vendor-provided hotfix or security patch that addresses this vulnerability; if a patch is not available, disable or restrict the CDE plugin’s scripting capabilities if supported, or temporarily disable the CDE feature to reduce exposure.
• Implement mitigations: restrict access to the CDE and related dashboards to only trusted administrators, enforce least privilege for users with CDE access, and consider network segmentation or firewall controls to limit exposure.
• Configuration and validation: after patching, reconfigure or verify that scripting capabilities in the CDE are either safely disabled or properly sanitized, and perform functional testing to ensure dashboards render correctly without allowing script execution.
• Monitoring and follow-up: enable enhanced logging around CDE usage, review dashboards for suspicious or previously stored scripts, and run periodic vulnerability scans to confirm remediation.

References

• Hitachi Vantara Pentaho Business Analytics Server - Resolved: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') (CVE-2022-3960)
• CWE-96: Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection')
• CAPEC-242 Code Injection