PT-2022-16898 · Geotools · Geotools

Published 2022-04-13 · Updated 2023-06-23 · CVE-2022-24818

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeoTools versions prior to 24.6 GeoTools versions prior to 25.6 GeoTools versions prior to 26.4

Description The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. This issue can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in newer versions of GeoTools.

Recommendations For versions prior to 24.6, upgrade to GeoTools 24.6 or later. For versions prior to 25.6, upgrade to GeoTools 25.6 or later. For versions prior to 26.4, upgrade to GeoTools 26.4 or later. As a temporary workaround, ensure that any downstream application does not allow usage of remotely provided JNDI strings. Restrict access to JNDI lookups to minimize the risk of exploitation. Avoid using user-provided JNDI names in the affected data sources until the issue is resolved.

Exploit

Fix

RCE

Weakness Enumeration

CWE-917

CWE-20

Related Identifiers

CVE-2022-24818

GHSA-JVH2-668R-G75X

Affected Products

Geotools

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24818.json · Exploit
• https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49 · Patch
• https://osv.dev/vulnerability/CVE-2022-24818 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24818 · Security Note
• https://github.com/geotools/geotools/security/advisories/GHSA-jvh2-668r-g75x · Note
• https://t.me/cibsecurity/40742 · Telegram Post
• https://t.me/cvenotify/28888 · Telegram Post