PT-2023-28341 · Geonode · Geonode

Imthatt

·

Published

2023-09-15

·

Updated

2023-11-04

·

CVE-2023-42439

CVSS v4.0

8.7

High

VectorAV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions GeoNode versions 3.2.0 through 4.1.3
Description A SSRF vulnerability exists, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. The application is using a whitelist, but the whitelist can be bypassed with @ or %40. For example, a GET request to /proxy/?url=http://development.demo.geonode.org%40geoserver:8080/geoserver/web will trick the application that the first host is a whitelisted address, but the browser will use @ or %40 as a credential to the host geoserver on port 8080, returning the data to that host on the response.
Recommendations For versions 3.2.0 through 4.1.3, update to version 4.1.3.post1 or later to resolve the issue. As a temporary workaround, consider restricting access to the /proxy/ API endpoint until a patch is available. Avoid using the url parameter in the affected API endpoint with @ or %40 characters until the issue is resolved.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-42439
GHSA-PXG5-H34R-7Q8P
PYSEC-2023-176

Affected Products

Geonode