// For flags

CVE-2022-24847

Improper Input Validation in GeoServer

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 1.19.6. Users unable to upgrade should restrict access to the `geoserver/web` and `geoserver/rest` via a firewall and ensure that the GeoWebCache is not remotely accessible.

GeoServer es un servidor de software de código abierto escrito en Java que permite a usuarios compartir y editar datos geoespaciales. El mecanismo de seguridad de GeoServer puede llevar a cabo una búsqueda JNDI no verificada, que a su vez puede ser usada para llevar a cabo una deserialización de clases y resultar en una ejecución de código arbitrario. Lo mismo puede ocurrir mientras son configurados los almacenes de datos con fuentes de datos ubicadas en JNDI, o mientras es configurado el mecanismo de cuota de disco. Para llevar a cabo cualquiera de los cambios anteriores, el ataque necesita haber obtenido derechos de administrador y usar la GUI de GeoServer, o su API REST. Las búsquedas van a ser restringidas en GeoServer versiones 2.21.0, 2.20.4, 1.19.6. Los usuarios que no puedan actualizar deberán restringir el acceso a "geoserver/web" y "geoserver/rest" por medio de un firewall y asegurarse de que el GeoWebCache no es accesible de forma remota

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Attack Vector
Network
Attack Complexity
Low
Authentication
Single
Confidentiality
Partial
Integrity
Partial
Availability
Partial
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-02-10 CVE Reserved
  • 2022-04-13 CVE Published
  • 2023-11-04 EPSS Updated
  • 2024-08-03 CVE Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-20: Improper Input Validation
  • CWE-917: Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
CAPEC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Osgeo
Search vendor "Osgeo"
 Geoserver
Search vendor "Osgeo" for product "Geoserver"
 < 2.19.6
Search vendor "Osgeo" for product "Geoserver" and version " < 2.19.6"
-
Affected
Osgeo
Search vendor "Osgeo"
 Geoserver
Search vendor "Osgeo" for product "Geoserver"
 >= 2.20.0 < 2.20.4
Search vendor "Osgeo" for product "Geoserver" and version " >= 2.20.0 < 2.20.4"
-
Affected