PT-2023-28987 · Geoserver · Geoserver

Jodygarnett · Published 2023-10-24 · Updated 2024-02-07 · CVE-2023-43795

Positive Technologies (AI Summary)

CVSS v3.1

8.6

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.22.5 GeoServer versions prior to 2.23.2 GeoServer version 2.20.5 GeoServer version 2.21.0

Description The OGC Web Processing Service (WPS) specification in GeoServer allows processing of information from any server using GET and POST requests, presenting an opportunity for Server Side Request Forgery (SSRF). This issue requires the WPS extension to be installed, the WPS security setting "Disable complex inputs" to be unselected, and security URL checks to be disabled. The vulnerability has been patched in versions 2.22.5 and 2.23.2.

Recommendations For GeoServer 2.20.5 and GeoServer 2.21.0: To disable complex remote inputs, navigate to Security > WPS Security page, locate the Complex Inputs heading, and select the check box for Disable loading complex inputs from remote references. For GeoServer 2.22.5 and GeoServer 2.23.2: To allow processing of complex inputs safely, navigate to Security > URL Checks, enable URL Checks, and check the user manual for examples of how to trust specific locations for external services. For GeoServer 2.24.0 and later: No action is required as processing of complex inputs safely is enabled by default.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

CVE-2023-43795

GHSA-5PR3-M5HM-9956

Affected Products

Geoserver

References · 12

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/43xxx/CVE-2023-43795.json · Exploit
• https://github.com/geoserver/geoserver/security/advisories/GHSA-5pr3-m5hm-9956 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-5pr3-m5hm-9956 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-43795 · Security Note
• https://osv.dev/vulnerability/CVE-2023-43795 · Vendor Advisory
• https://github.com/geoserver/geoserver · Note
• https://twitter.com/DhiyaneshDK/status/1720405772889121216 · Twitter Post
• https://docs.geoserver.org/latest/en/user/security/urlchecks.html · Note
• https://twitter.com/CVEnew/status/1716947964026048836 · Twitter Post
• https://twitter.com/prakhar0x01/status/1750222308655161579 · Twitter Post
• https://docs.geoserver.org/stable/en/user/services/wps/security.html#complex-inputs · Note
• https://twitter.com/0x2458/status/1755125564451475664 · Twitter Post