PT-2022-16896 · Janino+2 · Janino+2

Aaime + 1 · Published 2022-04-13 · Updated 2024-09-24 · CVE-2022-24816

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions JAI-EXT versions prior to 1.2.22 GeoServer (affected versions not specified)

Description Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. This affects the downstream GeoServer project.

Recommendations For JAI-EXT versions prior to 1.2.22, update to version 1.2.22 to patch the vulnerability. As a temporary workaround for users unable to upgrade, remove janino-x.y.z.jar from the classpath to negate the ability to compile Jiffle scripts from the final application.

Exploit

Fix

Code Injection

Weakness Enumeration

CWE-94

Related Identifiers

CVE-2022-24816

GHSA-V92F-JX6P-73RX

Affected Products

Geoserver

Jai-Ext

Janino

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24816.json · Exploit
• https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb · Patch
• https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24816 · Security Note
• https://osv.dev/vulnerability/GHSA-v92f-jx6p-73rx · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-24816 · Vendor Advisory
• https://github.com/geosolutions-it/jai-ext · Note
• https://twitter.com/linux_ly/status/1833113744513351914 · Twitter Post
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24816 · Note
• https://twitter.com/linux_ly/status/1827032727553765866 · Twitter Post
• https://t.me/cvenotify/84597 · Telegram Post
• https://t.me/cibsecurity/40743 · Telegram Post
• https://t.me/cvenotify/86290 · Telegram Post
• https://twitter.com/linux_ly/status/1838711265528811621 · Twitter Post
• https://t.me/cvenotify/28889 · Telegram Post