PT-2024-14126 · Geoserver · Geoserver

Sikeoka · Published 2024-03-20 · Updated 2024-12-18 · CVE-2023-51444

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.23.4 and 2.24.1

Description An arbitrary file upload vulnerability exists that enables an authenticated administrator with permissions to modify coverage stores through the "REST Coverage Store API" to upload arbitrary file contents to arbitrary file locations, which can lead to remote code execution. Coverage stores configured using relative paths have validation to prevent path traversal, but those using absolute paths do not. This issue can lead to executing arbitrary code, and an administrator with limited privileges could potentially exploit it to overwrite GeoServer security files and obtain full administrator privileges. Over 73,743 instances may be at risk.

Recommendations For versions prior to 2.23.4, update to version 2.23.4 or later. For versions prior to 2.24.1, update to version 2.24.1 or later. As a temporary workaround, consider restricting access to the REST Coverage Store API to minimize the risk of exploitation. Avoid using absolute paths for coverage stores until the issue is resolved.

Exploit

Fix

RCE

Unrestricted File Upload

Weakness Enumeration

CWE-434

CWE-20

Related Identifiers

CVE-2023-51444

GHSA-9V5Q-2GWQ-Q9HQ

Affected Products

Geoserver

References · 14

• 🔥 https://github.com/geoserver/geoserver/security/advisories/GHSA-9v5q-2gwq-q9hq · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/51xxx/CVE-2023-51444.json · Exploit
• https://github.com/geoserver/geoserver/commit/fe235b3bb1d7f05751a4a2ef5390c36f5c9e78ae · Patch
• https://github.com/geoserver/geoserver/commit/ca683170c669718cb6ad4c79e01b0451065e13b8 · Patch
• https://osv.dev/vulnerability/GHSA-9v5q-2gwq-q9hq · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-51444 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2023-51444 · Security Note
• https://github.com/geoserver/geoserver · Note
• https://github.com/geoserver/geoserver/pull/7222 · Note
• https://twitter.com/cracbot/status/1770899614629069289 · Twitter Post
• https://twitter.com/oktsec/status/1771266038530716159 · Twitter Post
• https://osgeo-org.atlassian.net/browse/GEOS-11176 · Note
• https://twitter.com/Mango7xy/status/1772824080041034152 · Twitter Post
• https://t.me/cvenotify/104812 · Telegram Post