GeoServer up to 2.23.4/2.24.1 REST Coverage Store API/REST Data Store API file inclusion

Summaryinfo

A vulnerability classified as problematic was found in GeoServer up to 2.23.4/2.24.1. Affected by this vulnerability is an unknown functionality of the component REST Coverage Store API/REST Data Store API. Executing a manipulation can lead to file inclusion. This vulnerability appears as CVE-2024-23634. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in GeoServer up to 2.23.4/2.24.1. It has been declared as problematic. This vulnerability affects an unknown function of the component REST Coverage Store API/REST Data Store API. The manipulation with an unknown input leads to a file inclusion vulnerability. The CWE definition for the vulnerability is CWE-73. The product allows user input to control or influence paths or file names that are used in filesystem operations. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file renaming vulnerability exists in versions prior to 2.23.5 and 2.24.2 that enables an authenticated administrator with permissions to modify stores through the REST Coverage Store or Data Store API to rename arbitrary files and directories with a name that does not end in `.zip`. Store file uploads rename zip files to have a `.zip` extension if it doesn't already have one before unzipping the file. This is fine for file and url upload methods where the files will be in a specific subdirectory of the data directory but, when using the external upload method, this allows arbitrary files and directories to be renamed. Renaming GeoServer files will most likely result in a denial of service, either completely preventing GeoServer from running or effectively deleting specific resources (such as a workspace, layer or style). In some cases, renaming GeoServer files could revert to the default settings for that file which could be relatively harmless like removing contact information or have more serious consequences like allowing users to make OGC requests that the customized settings would have prevented them from making. The impact of renaming non-GeoServer files depends on the specific environment although some sort of denial of service is a likely outcome. Versions 2.23.5 and 2.24.2 contain a fix for this issue.

The advisory is shared for download at github.com. This vulnerability was named CVE-2024-23634 since 01/19/2024. The exploitation appears to be easy. The attack can be initiated remotely. Additional levels of successful authentication are necessary for exploitation. There are neither technical details nor an exploit publicly available.

Upgrading to version 2.23.5 or 2.24.2 eliminates this vulnerability. Applying the patch 5d6af2f8ba9ad7dffae59575504a867159698772 is able to eliminate this problem. The bugfix is ready for download at github.com. The best possible mitigation is suggested to be upgrading to the latest version.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Name

• GeoServer

Version

• 2.23.0
• 2.23.1
• 2.23.2
• 2.23.3
• 2.23.4
• 2.24.0
• 2.24.1

License

• open-source

Website

• Product: https://github.com/geoserver/geoserver/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion