Pierluigi Paganini
July 16, 2024
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) an OSGeo GeoServer GeoTools eval injection vulnerability, tracked as (CVSS score of 9.8), to its .
GeoServer is an open-source server that allows users to share and edit geospatial data.
GeoServer versions prior to 2.23.6, 2.24.4, and 2.25.2 are vulnerable to Remote Code Execution (RCE) due to unsafe evaluation of property names as XPath expressions. This issue arises because the GeoTools library API, which GeoServer uses, evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library, allowing arbitrary code execution. The vulnerability impacts all GeoServer instances, as it incorrectly applies XPath evaluation to simple feature types. An attacker can exploit the vulnerability through various requests such as WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic, and WPS Execute requests. The vulnerability has been addressed in versions 2.23.6, 2.24.4, and 2.25. The advisory also provides a workaround that consists of removing the gt-complex-x.y.jar file from GeoServer, where x.y represents the GeoTools version, though this may break some functionality or prevent deployment if the module is needed.
According to , FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by August 5, 2024.
Follow me on Twitter: and and Mastodon
(SecurityAffairs – hacking, US CISA Known Exploited Vulnerabilities catalog)
