CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 0CVE-2024-36404 – GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions
https://notcve.org/view.php?id=CVE-2024-36404
GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. • https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852 https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea https://github.com/geotools/geotools/pull/4797 https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w https://osgeo-org.atlassian.net/browse/GEOT-7587 https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download https://sourceforge.net/projects/geotools/files/GeoTo • CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 9.8EPSS: 95%CPEs: 6EXPL: 14CVE-2024-36401 – OSGeo GeoServer GeoTools Eval Injection Vulnerability
https://notcve.org/view.php?id=CVE-2024-36401
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. • https://github.com/daniellowrie/CVE-2024-36401-PoC https://github.com/Mr-xn/CVE-2024-36401 https://github.com/RevoltSecurities/CVE-2024-36401 https://github.com/Chocapikk/CVE-2024-36401 https://github.com/bigb0x/CVE-2024-36401 https://github.com/Niuwoo/CVE-2024-36401 https://github.com/zgimszhd61/CVE-2024-36401 https://github.com/yisas93/CVE-2024-36401-PoC https://github.com/jakabakos/CVE-2024-36401-GeoServer-RCE https://github.com/PunitTailor55/GeoServer-CVE-2024-36401 h • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') •
CVSS: 9.8EPSS: 0%CPEs: 5EXPL: 1CVE-2023-25158 – Unfiltered SQL Injection in Geotools
https://notcve.org/view.php?id=CVE-2023-25158
GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation. • https://github.com/murataydemir/CVE-2023-25157-and-CVE-2023-25158 https://github.com/geotools/geotools/commit/64fb4c47f43ca818c2fe96a94651bff1b3b3ed2b https://github.com/geotools/geotools/security/advisories/GHSA-99c3-qc2q-p94m • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.2EPSS: 0%CPEs: 3EXPL: 1CVE-2022-24818 – Unchecked JNDI lookups in GeoTools
https://notcve.org/view.php?id=CVE-2022-24818
GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings. • https://github.com/mbadanoiu/CVE-2022-24818 https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49 https://github.com/geotools/geotools/security/advisories/GHSA-jvh2-668r-g75x • CWE-20: Improper Input Validation CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection') •