CVE-2024-23642: Stored Cross-Site Scripting (XSS) in GeoServer's Simple SVG Renderer
Summary
CVE-2024-23642: GeoServer's Simple SVG Renderer vulnerable to Stored Cross-Site Scripting (XSS). Affects org.geoserver:gs-wms across 2 version ranges.
< 2.23.4
>= 2.24.0, < 2.24.1
Fixed in 2.23.4 or 2.24.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeoServer is an open-source server for sharing geospatial data. It provides a web-based interface for managing and publishing geospatial data in various formats. The Simple SVG Renderer is a component of GeoServer that allows users to render maps in SVG format. SVG (Scalable Vector Graphics) is an XML-based vector image format commonly used for displaying maps and other graphical content on the web. The Simple SVG Renderer in GeoServer is vulnerable to a stored cross-site scripting (XSS) attack, which allows an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog. This payload will execute in the context of another user's browser when viewed in the WMS GetMap SVG Output Format with the Simple SVG renderer enabled.
Vulnerability Detail
The stored cross-site scripting (XSS) vulnerability in GeoServer's Simple SVG Renderer allows an attacker with administrator privileges to store a malicious JavaScript payload in the GeoServer catalog. When another user views a map in the WMS GetMap SVG Output Format with the Simple SVG renderer enabled, the payload will execute in their browser. This can lead to various security risks, including the attacker being able to perform actions on behalf of the victim user, view sensitive information, modify data, and initiate malicious attacks that appear to originate from the victim user.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.23.42.23.4 -
>= 2.24.0, < 2.24.12.24.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If updating GeoServer is not immediately possible, a temporary workaround is to disable the Simple SVG Renderer or restrict access to the WMS GetMap SVG Output Format. Disabling the Simple SVG Renderer will prevent the execution of any stored JavaScript payloads. Restricting access to the WMS GetMap SVG Output Format can be done through data and service security configurations, limiting the ability for users to trigger the XSS vulnerability.
Conclusion
The stored cross-site scripting (XSS) vulnerability in GeoServer's Simple SVG Renderer can be mitigated by updating to the latest version of GeoServer or by applying the recommended workarounds. It is important to prioritize the security of your GeoServer installation to prevent potential exploitation of this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.geoserver:gs-wms →
FAQ
GeoServer is an open-source server for sharing geospatial data. It provides a web-based interface for managing and publishing geospatial data in various formats.
The Simple SVG Renderer is a component of GeoServer that allows users to render maps in SVG format. SVG (Scalable Vector Graphics) is an XML-based vector image format commonly used for displaying maps and other graphical content on the web.
Stored cross-site scripting (XSS) is a type of web vulnerability where an attacker is able to inject malicious scripts into a website or web application. These scripts are then executed in the browsers of other users who visit the affected pages, allowing the attacker to perform various malicious actions.
The potential risks of this vulnerability include the attacker being able to perform actions on behalf of the victim user, view sensitive information, modify data, and initiate malicious attacks that appear to originate from the victim user.
To mitigate this vulnerability, it is recommended to update GeoServer to version 2.23.4 or later. Alternatively, you can disable the Simple SVG Renderer or restrict access to the WMS GetMap SVG Output Format.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.geoserver:gs-wms.
