CVE-2022-24847 Improper Input Validation in GeoServer
An authenticated admin can trigger arbitrary code execution via unsafe JNDI lookups in GeoServer's security or configuration mechanisms.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-24847?
CVE-2022-24847 is a high-severity unsafe deserialization vulnerability in geoserver, published on 13 Apr 2022. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 1.19.6. Users unable to upgrade should restrict access to the `geoserver/web` and `geoserver/rest` via a firewall and ensure that the GeoWebCache is not remotely accessible.
Which versions are affected by CVE-2022-24847?
4 open source packages ship an affected version, including org.geoserver:gs-main. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.geoserver:gs-main Maven | All versions | 2.19.6 |
org.geoserver:gs-main Maven | All versions | 2.19.6 |
org.geoserver:gs-main Maven | From 2.20.0 | 2.20.4 |
org.geoserver:gs-main Maven | From 2.20.0 | 2.20.4 |
Products include Osgeo Geoserver.
How do I fix CVE-2022-24847?
Upgrade org.geoserver:gs-main to a fixed version for your release line: 2.19.6 or 2.20.4.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2022-24847 being exploited?
There is no known exploitation of CVE-2022-24847 in the wild and no public exploit code.
Other vulnerabilities in geoserver
- CVE-2023-25157 Unfiltered SQL Injection Vulnerabilities in Geoserver
- CVE-2024-34711 GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)
- CVE-2023-41339 Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer
- CVE-2023-43795 WPS Server Side Request Forgery in GeoServer
- CVE-2024-29198 GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost
Sources
Also known as GHSA-4pm3-f52j-8ggh.