GitHub Advisoryadvisory · Maven

GHSA-4pm3-f52j-8ggh Improper Input Validation in GeoServer

HIGH Published 2022-04-22 Modified 2022-04-22 Official page ↗
Aliases
CVE-2022-24847
Ecosystem
Maven
Packages
org.geoserver:gs-main
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-20, CWE-917
Reviewed
2022-04-22

Affected packages

• Maven org.geoserver:gs-main: >= 2.20.0, < 2.20.4 → fixed in 2.20.4 • Maven org.geoserver:gs-main: < 2.19.6 → fixed in 2.19.6

Description

Impact The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. Patches The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 2.19.6. Workarounds Protection can be achieved by making the GUI (``geoserver/web``), the REST configuration (``geoserver/rest``) and the embedded GeoWebCache configuration (``geoserver/gwc/rest``) unreachable from remote hosts, in addition to protecting access to the file system where the GeoServer configuration is stored.

Related

Alias · CVE (1)

  • CVE-2022-24847 GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. vulnerability

Weakness · CWE (2)

  • CWE-20 Improper Input Validation weakness
  • CWE-917 Improper Neutralization of Special Elements used in an Expression Language Statement weakness

References