CVE-2024-23640: Stored Cross-Site Scripting (XSS) in GeoServer's Style Publisher
Summary
CVE-2024-23640: GeoServer's Style Publisher vulnerable to Stored Cross-Site Scripting (XSS). Affects org.geoserver:gs-main versions < 2.23.3. Fixed in 2.23.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeoServer is an open-source server for sharing geospatial data. It allows users to publish and manage geospatial data from various sources. The Style Publisher is a component of GeoServer that enables administrators to upload and manage styles and legends for geospatial data. This vulnerability affects the 'gs-main' and 'gs-ows' packages of GeoServer.
Vulnerability Detail
A stored cross-site scripting (XSS) vulnerability exists in GeoServer's Style Publisher. An authenticated administrator with workspace-level privileges can store a JavaScript payload in uploaded style/legend resources or in a specially crafted datastore file. When viewed in the Style Publisher, this payload will execute in the context of another user's browser. While access to the Style Publisher is available to all users, data security measures may limit the ability to trigger the XSS. If exploited, an attacker can perform actions, view information, modify data, and initiate interactions on behalf of the victim user.
How To Fix
Minimum fixed version
2.23.3
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by updating the affected packages.
Conclusion
The stored cross-site scripting (XSS) vulnerability in GeoServer's Style Publisher can allow an attacker to execute malicious JavaScript code in the context of another user's browser. To mitigate this vulnerability, it is recommended to update the 'gs-main' and 'gs-ows' packages of GeoServer to version 2.23.3 or later. For further assistance or support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.geoserver:gs-main →
FAQ
GeoServer is an open-source server for sharing geospatial data. It allows users to publish and manage geospatial data from various sources.
The Style Publisher is a component of GeoServer that enables administrators to upload and manage styles and legends for geospatial data.
Any user or organization using GeoServer with versions prior to 2.23.3 and having the 'gs-main' and 'gs-ows' packages installed is affected by this vulnerability.
If an attacker exploits this vulnerability, they can perform actions, view information, modify data, and initiate interactions on behalf of the victim user within the application.
No, there is no known workaround for this vulnerability. It is crucial to update the affected packages to fix the issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.geoserver:gs-main.
