CVE-2024-27091 GeoNode stored XSS to full account takeover
Stored XSS in GeoNode allows attackers to steal CSRF tokens and change victim email addresses, leading to full account takeover.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2024-27091?
CVE-2024-27091 is a medium-severity cross-site scripting vulnerability in geonode, published on 27 Mar 2024. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
GeoNode is a geospatial content management system, a platform for the management and publication of geospatial data. An issue exists within GEONODE where the current rich text editor is vulnerable to Stored XSS. The applications cookies are set securely, but it is possible to retrieve a victims CSRF token and issue a request to change another user's email address to perform a full account takeover. Due to the script element not impacting the CORS policy, requests will succeed. This vulnerability is fixed in 4.2.3.
Weakness: CWE-79
Which versions are affected by CVE-2024-27091?
3 open source packages ship an affected version, including geonode. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
geonode PyPI | From 3.2.1 | 4.2.3 |
geonode PyPI | From 3.2.1 | 4.2.3 |
geonode PyPI | From 3.2.1 | 4.2.3 |
Products include Geosolutionsgroup Geonode.
How do I fix CVE-2024-27091?
Upgrade geonode to 4.2.3 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-27091 being exploited?
There is no known exploitation of CVE-2024-27091 in the wild and no public exploit code.
Other vulnerabilities in geonode
- CVE-2023-42439 GeoNode SSRF Bypass to return internal host data
- CVE-2023-40017 Geonode Server Side Request Forgery vulnerability
- CVE-2023-28442 Geoserver for GeoNode sensitive information leak
- CVE-2023-26043 XML External Entity (XXE) injection in GeoServer style upload functionality
- CVE-2026-39921 GeoNode < 4.4.5, 5.0.2 SSRF via Document Upload
Sources
Also known as GHSA-rwcv-whm8-fmxm, PYSEC-2024-320.