Server-side Request Forgery in Hitachi Vantara Pentaho Business Analytics Server

CVE-2024-37359

Summary

The Hitachi Vantara Pentaho Business Analytics Server has a vulnerability that allows attackers to send crafted URLs to unexpected hosts. This occurs because the server fails to validate the Host header of incoming requests. As a result, malicious actors can exploit the server to conduct port scanning within internal networks, bypass firewall access controls, or even initiate requests using alternative protocols, potentially gaining unauthorized access to sensitive documents or resources.

References