CVE-2022-24847: Improper Input Validation in GeoServer
Summary
CVE-2022-24847: Improper Input Validation in GeoServer. Affects org.geoserver:gs-main across 2 version ranges.
< 2.19.6
>= 2.20.0, < 2.20.4
Fixed in 2.19.6 or 2.20.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeoServer is an open-source server for sharing geospatial data. It provides a web-based interface for managing and publishing geospatial data in various formats. The 'org.geoserver:gs-main' package is a core component of GeoServer that handles the main functionality of the server. This package is vulnerable to an improper input validation issue that can lead to arbitrary code execution.
Vulnerability Detail
The vulnerability in GeoServer allows for unchecked JNDI lookups, which can be exploited to perform class deserialization and execute arbitrary code. This vulnerability can be triggered when configuring data stores with data sources located in JNDI or setting up the disk quota mechanism. An attacker with admin rights can abuse the GeoServer GUI or REST API to exploit this vulnerability. The impact of this vulnerability is high, as it can result in unauthorized code execution and compromise the integrity and confidentiality of the affected system.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.19.62.19.6 -
>= 2.20.0, < 2.20.42.20.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, access to the GeoServer GUI (geoserver/web), REST configuration (geoserver/rest), and embedded GeoWebCache configuration (geoserver/gwc/rest) should be restricted from remote hosts. Additionally, access to the file system where the GeoServer configuration is stored should be protected to prevent unauthorized modifications.
Conclusion
The vulnerability in GeoServer can lead to arbitrary code execution and compromise the security of the affected system. It is crucial to update to the patched versions of GeoServer and implement the recommended security measures to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.geoserver:gs-main →
FAQ
GeoServer is an open-source server for sharing geospatial data. It provides a web-based interface for managing and publishing geospatial data in various formats.
The 'org.geoserver:gs-main' package is a core component of GeoServer that handles the main functionality of the server.
The vulnerability allows for arbitrary code execution, which can compromise the integrity and confidentiality of the affected system.
The vulnerability can be exploited by an attacker with admin rights using the GeoServer GUI or REST API to perform unchecked JNDI lookups and execute arbitrary code.
To protect your system, it is recommended to update to the patched versions of GeoServer and restrict access to the GeoServer GUI, REST configuration, and file system where the GeoServer configuration is stored.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.geoserver:gs-main.
