CVE-2023-40017 Geonode Server Side Request Forgery vulnerability

High 7.5 Published 24 Aug 2023 Updated 2 Oct 2024

An attacker can exploit a proxy endpoint to port scan internal hosts and access internal network resources in GeoNode.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2023-40017?

CVE-2023-40017 is a high-severity server-side request forgery vulnerability in geonode, published on 24 Aug 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint `/proxy/?url=` does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and request information from internal hosts. A patch is available at commit a9eebae80cb362009660a1fd49e105e7cdb499b9.

Weakness: CWE-918

Which versions are affected by CVE-2023-40017?

3 open source packages ship an affected version, including geonode. It affects 1 product.

Package	Affected	Fixed in
`geonode` PyPI	From `3.2.0`	`4.1.3`
`geonode` PyPI	From `3.2.0`	`4.2.0`
`geonode` PyPI	From `3.2.0`	`4.2.0`

Products include Geosolutionsgroup Geonode.

How do I fix CVE-2023-40017?

Upgrade geonode to a fixed version for your release line: 4.1.3 or 4.2.0.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2023-40017 being exploited?

There is no known exploitation of CVE-2023-40017 in the wild and no public exploit code.

Sources

Also known as GHSA-rmxg-6qqf-x8mr, PYSEC-2023-269.