CVE-2023-41877: GeoServer log file path traversal vulnerability in org.geoserver:gs-main
Summary
CVE-2023-41877: GeoServer log file path traversal vulnerability. Affects org.geoserver:gs-main versions < 2.23.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeoServer is an open-source server for sharing geospatial data. It allows users to publish and manage geospatial data and services. The 'gs-main' package is a core component of GeoServer that provides essential functionality for the server. This package is vulnerable to a log file path traversal vulnerability.
Vulnerability Detail
The vulnerability arises when a GeoServer Administrator misconfigures the Global Settings for log file location to an arbitrary location. This allows an attacker with access to the admin console to read files via the GeoServer Logs page. Additionally, the attacker can leverage this vulnerability to execute remote code or cause denial of service by overwriting critical GeoServer files.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
A system administrator responsible for running GeoServer can define the GEOSERVER_LOG_FILE parameter to prevent the global setting from being used. The GEOSERVER_LOG_LOCATION parameter can be set as a system property, environment variable, or servlet context parameter. Here are examples of how to set the GEOSERVER_LOG_LOCATION parameter:
Environmental variable:
export GEOSERVER_LOG_LOCATION=/var/opt/geoserver/logs
System property: -DGEOSERVER_LOG_LOCATION=/var/opt/geoserver/logs
Web application WEB-INF/web.xml:
<context-param>
<param-name>GEOSERVER_LOG_LOCATION</param-name>
<param-value>/var/opt/geoserver/logs</param-value>
</context-param>
Tomcat conf/Catalina/localhost/geoserver.xml: <Context>
<Parameter name="GEOSERVER_LOG_LOCATION" value="/var/opt/geoserver/logs" override="false"/>
</Context>
Conclusion
The GeoServer log file path traversal vulnerability in the 'gs-main' package can lead to unauthorized file access, remote code execution, or denial of service. It is crucial for GeoServer administrators to properly configure the log file location and implement the recommended workarounds to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.geoserver:gs-main →
FAQ
This vulnerability allows an attacker with GeoServer Administrator access to read files, execute remote code, or cause denial of service by overwriting critical GeoServer files.
Organizations or individuals using GeoServer versions up to 2.23.4 and have misconfigured the Global Settings for log file location are affected by this vulnerability.
No, there are currently no patches available for this vulnerability. Interested parties can contact geoserver-security@lists.osgeo.org for recommendations on developing a fix.
System administrators responsible for running GeoServer can define the GEOSERVER_LOG_FILE parameter and set the GEOSERVER_LOG_LOCATION parameter to a secure location. This will prevent the vulnerability from being exploited.
You can use Vulert's playground at Vulert Scanner to check if your GeoServer installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities in software using just the pom.xml file.
Related vulnerabilities
Recent vulnerabilities recorded for org.geoserver:gs-main.
