CVE-2023-35042: GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language
Summary
CVE-2023-35042: GeoServer RCE due to improper control of generation of code in jai-extJiffle map algebra language. Affects org.geoserver:gs-wms across 3 version ranges.
< 2.18.6
>= 2.19.0, < 2.19.6
>= 2.20.0, < 2.20.4
Fixed in 2.18.6, 2.19.6 or 2.20.4, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeoServer is an open-source server for sharing geospatial data. It allows users to publish and manage geospatial data from a variety of sources. One of the features of GeoServer is the ability to execute map algebra using the Jiffle map algebra language provided by the jai-ext library. This language allows for efficient execution of map algebra over large images. However, a vulnerability (CVE-2022-24816) has been discovered in Jiffle that allows for code injection by crafting a Jiffle invocation. This vulnerability affects GeoServer when it is configured to allow remote requests. The injection can be performed through a remote request, making it possible for remote attackers to execute arbitrary code on the server.
Vulnerability Detail
The vulnerability allows remote attackers to execute arbitrary code on a GeoServer instance by exploiting the code injection vulnerability in the Jiffle map algebra language. This can be done by crafting a Jiffle invocation in a remote request, such as a wps:Execute request with a wps:LiteralData containing java.lang.Runtime.getRuntime().exec code. The vulnerability has been observed being exploited in the wild in June 2023. The impact of this vulnerability is critical, as it allows attackers to gain unauthorized access to the server and potentially perform malicious actions.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.18.62.18.6 -
>= 2.19.0, < 2.19.62.19.6 -
>= 2.20.0, < 2.20.42.20.4
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
To mitigate the vulnerability, follow these steps:
- Stop GeoServer.
- Open the GeoServer WAR file.
- Navigate to the
WEB-INF/libdirectory. - Remove the
janino-<version>.jarfile. - Restart GeoServer.
This workaround disables the Jiffle functionality, preventing the code injection vulnerability.
Conclusion
The vulnerability in GeoServer that allows for remote code execution due to the improper control of code generation in the Jiffle map algebra language is a critical issue. It can be exploited by remote attackers to execute arbitrary code on the server, potentially leading to unauthorized access and malicious actions. To mitigate the vulnerability, it is recommended to upgrade GeoServer to the latest version or apply the provided workaround. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.geoserver:gs-wms →
FAQ
GeoServer is an open-source server for sharing geospatial data. It allows users to publish and manage geospatial data from various sources.
Jiffle is a map algebra language provided by the jai-ext library. It allows for efficient execution of map algebra over large images.
The vulnerability allows remote attackers to execute arbitrary code on a GeoServer instance, potentially gaining unauthorized access and performing malicious actions.
Yes, this vulnerability has been observed being exploited in the wild in June 2023.
To fix this vulnerability, it is recommended to upgrade GeoServer to the latest version. If an immediate upgrade is not possible, a mitigation can be applied by removing the janino-<version>.jar file from the GeoServer WAR file.
Related vulnerabilities
Recent vulnerabilities recorded for org.geoserver:gs-wms.
