GitHub Advisoryadvisory · Maven

GHSA-v92f-jx6p-73rx Improper Control of Generation of Code ('Code Injection') in jai-ext

CRITICAL Published 2023-09-19 Modified 2025-10-22 Official page ↗
Aliases
CVE-2022-24816
Ecosystem
Maven
Packages
it.geosolutions.jaiext.jiffle:jt-jiffle, it.geosolutions.jaiext.jiffle:jt-jiffle-language
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:H
Weaknesses
CWE-94
Reviewed
2023-09-19

Affected packages

• Maven it.geosolutions.jaiext.jiffle:jt-jiffle: < 1.1.22 → fixed in 1.1.22 • Maven it.geosolutions.jaiext.jiffle:jt-jiffle-language: < 1.1.22 → fixed in 1.1.22

Description

Impact Programs using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Patches Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Workarounds Negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath. References None.

Related

Alias · CVE (1)

  • CVE-2022-24816 JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References