CVE-2024-37361
Published: 20 February 2025
Summary
CVE-2024-37361 is a critical-severity Deserialization of Untrusted Data (CWE-502) vulnerability in Pentaho Business Analytics Server (inferred from references). Its CVSS base score is 9.9 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 42.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2024-37361 is a deserialization of untrusted data vulnerability (CWE-502) affecting Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x. The application deserializes untrusted JSON data without sufficiently verifying that the resulting data will be valid or constraining the parser to approved classes and methods. This lack of restrictions on gadget chains—series of instances and method invocations that can self-execute during deserialization—allows attackers to leverage them for unauthorized actions.
The vulnerability has a CVSS v3.1 base score of 9.9 (AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H), indicating it is exploitable over the network with low attack complexity and no user interaction, but requires low privileges. An authenticated attacker with low privileges can supply malicious JSON data, triggering gadget chains during deserialization to achieve high-impact confidentiality, integrity, and availability compromises, including potential remote code execution before the object is returned to the caller.
The Hitachi Vantara Pentaho support advisory confirms the issue is resolved in versions 10.2.0.0 and 9.3.0.9. Security practitioners should upgrade affected installations to these versions for mitigation. Details are available at https://support.pentaho.com/hc/en-us/articles/34299135441805--Resolved-Hitachi-Vantara-Pentaho-Business-Analytics-Server-Deserialization-of-Untrusted-Data-Versions-before-10-2-0-0-and-9-3-0-9-including-8-3-x-Impacted-CVE-2024-37361.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4597
Vulnerability details
The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid. (CWE-502) Hitachi Vantara Pentaho Business Analytics Server versions before 10.2.0.0 and 9.3.0.9, including 8.3.x, deserialize untrusted JSON data without constraining the parser to approved classes…
more
and methods. When developers place no restrictions on "gadget chains," or series of instances and method invocations that can self-execute during the deserialization process (i.e., before the object is returned to the caller), it is sometimes possible for attackers to leverage them to perform unauthorized actions.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Deserialization RCE in network-exposed analytics server directly enables exploitation of public-facing applications.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mitigates the CVE by requiring timely application of vendor patches that fix the unsafe JSON deserialization lacking class/method constraints.
Validates untrusted JSON inputs prior to deserialization to block malicious gadget chains that enable unauthorized actions like RCE.
Restricts untrusted information inputs to the application, limiting the opportunity for attackers to supply exploitable JSON data.