PT-2022-16920 · Unknown+1 · Geowebcache+1

Aaime · Published 2022-04-14 · Updated 2022-04-22 · CVE-2022-24846

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeoWebCache versions prior to 1.21.0 GeoWebCache versions prior to 1.20.2 GeoWebCache versions prior to 1.19.3

Description The GeoWebCache disk quota mechanism can perform an unchecked JNDI lookup, which can be used to perform class deserialization and result in arbitrary code execution. The JNDI strings are provided via a local configuration file in GeoWebCache, while in GeoServer, a user interface is provided to perform the same, accessible remotely with admin-level login. These lookups are unrestricted in scope and can lead to code execution.

Recommendations For versions prior to 1.21.0, update to version 1.21.0 to restrict the JNDI lookups. For versions prior to 1.20.2, update to version 1.20.2 to restrict the JNDI lookups. For versions prior to 1.19.3, update to version 1.19.3 to restrict the JNDI lookups. As a temporary workaround, consider restricting access to the admin-level login to minimize the risk of exploitation.

Exploit

Fix

Deserialization of Untrusted Data

RCE

Weakness Enumeration

CWE-502

CWE-20

Related Identifiers

CVE-2022-24846

GHSA-4V22-V8JP-438R

Affected Products

Geoserver

Geowebcache

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24846.json · Exploit
• https://osv.dev/vulnerability/CVE-2022-24846 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-24846 · Security Note
• https://github.com/GeoWebCache/geowebcache/security/advisories/GHSA-4v22-v8jp-438r · Note
• https://t.me/cvenotify/28976 · Telegram Post
• https://t.me/cibsecurity/40840 · Telegram Post