RCE in Geoserver
CVE-2022-24847
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 1.19.6. Users unable to upgrade should restrict access to the `geoserver/web` and `geoserver/rest` via a firewall and ensure that the GeoWebCache is not remotely accessible.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.2 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.016 (74.2th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 74th percentile — 74.2% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.015 · newest: 0.016 · change: +0.001
Affected products
- Geoserver — versions >= 2.20.0, < 2.20.4, < 2.19.6
- Osgeo Geoserver
Weakness classification (CWE)
References
- github.com/geoserver/geoserver/security/advisories/GHSA-4pm3-f52j-8ggh (Third Party Advisory, Mitigation)
Frequently asked questions
- What is CVE-2022-24847?
- CVE-2022-24847 is a high-severity vulnerability in Geoserver, classified under Improper Input Validation. CVSS score: 7.2/10. Published 2022-04-13.
- How severe is CVE-2022-24847?
- High severity. CVSS v3 base score is 7.2 out of 10.