PT-2024-13006 · Geoserver · Geoserver

Sumiitgurjar · Published 2024-03-20 · Updated 2024-12-18 · CVE-2023-41877

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeoServer versions 2.23.4 and prior

Description A path traversal vulnerability requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location to an arbitrary location. The admin console GeoServer Logs page provides a preview of these contents. This can be used to read files via the admin console GeoServer Logs page. It is also possible to leverage remote code execution or cause denial of service by overwriting key GeoServer files.

Recommendations For GeoServer versions 2.23.4 and prior, a system administrator responsible for running GeoServer can use the GEOSERVER LOG FILE setting to override any configuration option provided by the Global Settings page. The GEOSERVER LOG LOCATION parameter can be set as system property, environment variables, or servlet context parameters. For example, the environmental variable can be set using export GEOSERVER LOG LOCATION=/var/opt/geoserver/logs. Alternatively, the system property can be set using -DGEOSERVER LOG LOCATION=/var/opt/geoserver/logs. Additionally, the GEOSERVER LOG LOCATION parameter can be configured in the web application WEB-INF/web.xml or Tomcat conf/Catalina/localhost/geoserver.xml files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2023-41877

GHSA-8G7V-VJRC-X4G5

Affected Products

Geoserver

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/41xxx/CVE-2023-41877.json · Exploit
• https://github.com/geoserver/geoserver/security/advisories/GHSA-8g7v-vjrc-x4g5 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8g7v-vjrc-x4g5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-41877 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-41877 · Security Note
• https://github.com/geoserver/geoserver · Note
• https://docs.geoserver.org/latest/en/user/configuration/globalsettings.html#log-location · Note
• https://twitter.com/cracbot/status/1770899612112437636 · Twitter Post
• https://t.me/cvenotify/104811 · Telegram Post