writeups.xyz / Pentah0wnage: Pre-Auth RCE in Pentaho Business Analytics Server

Submitter : c2a

Date: 4 April 2023

Bounty : undisclosed

Vulnerabilities :

• RCE
• SSTI
• Authorization Bypass
• Groovy Scripting

Programs :

• Hitachi Vantara (Pentaho)

Authors :

• Harry Withington

Link :
https://research.aurainfosec.io/pentest/pentah0wnage/