CVE-2023-42439: SSRF Vulnerability in GeoNode
Summary
CVE-2023-42439: GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. Affects geonode versions >= 3.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeoNode is an open source platform that enables the creation, sharing, and collaborative use of geospatial data. It provides a range of features for managing and visualizing geospatial information. However, a vulnerability has been discovered in GeoNode version 3.2.0 and above, which allows for Server-Side Request Forgery (SSRF). This vulnerability bypasses existing controls and enables an attacker to request internal services, potentially leading to unauthorized access and data leakage.
Vulnerability Detail
The SSRF vulnerability in GeoNode arises due to a bypass of the application's whitelist. Although the application employs a whitelist to restrict requests to specific hosts, this can be circumvented. By tricking the application into considering the first host as whitelisted, an attacker can use the browser to send a request to the geoserver on port 8080, appending @ or %40 as a credential. This allows the attacker to perform a full read SSRF and retrieve data from the internal network. At present, no patched version of GeoNode is available.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, it is advisable to restrict access to the geoserver on port 8080 from external networks. This can be achieved by configuring firewall rules or network-level access controls to only allow connections from trusted sources.
Conclusion
The SSRF vulnerability in GeoNode poses a significant risk as it allows unauthorized access to internal services and potential data leakage. It is crucial to update GeoNode to a patched version as soon as one becomes available. In the meantime, implementing additional security measures and following best practices can help mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for geonode →
FAQ
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data.
Server-Side Request Forgery (SSRF) is a vulnerability that allows an attacker to make requests to internal resources from a targeted server.
The vulnerability in GeoNode allows an attacker to bypass the application's whitelist and send requests to internal services, potentially leading to unauthorized access and data leakage.
As of now, no patched version of GeoNode is available. It is recommended to stay updated with the latest security advisories and apply patches as soon as they are released.
To mitigate the risk of SSRF attacks, it is recommended to implement network segmentation, access controls, and regularly update software with security patches.
References
Related vulnerabilities
Recent vulnerabilities recorded for geonode.
