What is CVE-2022-24816?

CVE-2022-24816 is a critical-severity vulnerability in Geosolutionsgroup Jai-Ext, classified under Code Injection. CVSS score: 10.0/10. Published 2022-04-13.

How severe is CVE-2022-24816?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Is CVE-2022-24816 known to be exploited?

Yes. CVE-2022-24816 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2024-06-26), indicating it is being actively exploited. 8 public proof-of-concept repositories are indexed.

RCE in Geosolutionsgroup Jai-Ext

CVE-2022-24816

JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

Vulnerability class: RCE (Remote Code Execution)

EPSS: 0.985 (99.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.

Affected products

Geosolutionsgroup Jai-ext
Geosolutions-it Jai-ext — versions < 1.1.22

Weakness classification (CWE)

CWE-94 — Code Injection

CISA KEV (Known Exploited Vulnerabilities)

This CVE is on the CISA KEV catalog, added on 2024-06-26. CISA KEV inclusion means CISA has confirmed in-the-wild exploitation; US federal agencies are required to remediate within a published due date.

BOD 22-01 due date: 2024-07-17.

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public proof-of-concept exploits

References

security-advisories@github.com (x_refsource_CONFIRM, Vendor Advisory)
security-advisories@github.com (Patch, x_refsource_MISC)
134c704f-9b21-4f2e-91b3-4a467353bcc0 (US Government Resource)

Frequently asked questions

What is CVE-2022-24816?: CVE-2022-24816 is a critical-severity vulnerability in Geosolutionsgroup Jai-Ext, classified under Code Injection. CVSS score: 10.0/10. Published 2022-04-13.
How severe is CVE-2022-24816?: Critical severity. CVSS v3 base score is 10.0 out of 10.
Is CVE-2022-24816 known to be exploited?: Yes. CVE-2022-24816 is listed in the CISA Known Exploited Vulnerabilities catalog (added 2024-06-26), indicating it is being actively exploited. 8 public proof-of-concept repositories are indexed.