Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
5 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a plain GeoServer instance (no extension or community modules) for WMS GetFeatureInfo HTML and JSON and WMS GetMap KML and GeoRSS output formats. Details The org.geoserver.template.TemplateUtils.getSafeConfiguration() method attempts to block access to the class freemarker.template.utility.Execute but it is still possible to gain access to it and other sensitive functionality by chaining a specific sequence of method calls. Impact This vulnerability can lead to executing arbitrary code and reading and writing arbitrary files. Resolution GeoServer 2.27.0 addresses this vulnerability with several new application properties: GEOSERVERFREEMARKERBLOCKLIST GEOSERVERFREEMARKERALLOWLIST…
Recommended action: Upgrade to 2.27.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A GeoServer that uses ENTITYRESOLUTIONALLOWLIST may allow attacker to perform unauthenticated Server-Side Request Forgery (SSRF). Details This vulnerability requires that GeoServer is set up to use a proxy base URL and the ENTITYRESOLUTIONALLOWLIST (default since 2.25.0): Impact This vulnerability allows an attacker to cause GeoServer to make requests to an unintended location. Workaround GeoServer installations are only affected by this vulnerability if they use a proxy base URL that does not contain a URL path or end with a slash (e.g., https://somesite.org instead of https://somesite.org/ or https://somesite.org/geoserver). If the proxy base URL does not contain a path, adding a slash to the end of the URL will mitigate this vulnerability. Resources https://osgeo-org.atlassian.net/browse/GEOS-11867 https://github.com/geoserver/geoserver/pull/8622 Credits: - Le Mau Anh Phong at Verichains Cyber Force
Recommended action: Upgrade to 2.27.3 or 2.26.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GeoServer's Server Status page and REST API (at /geoserver/rest/about/status) lists all environment variables and Java properties to any GeoServer user with administrative rights as part of those modules' status message. These variables/properties can also contain sensitive information, such as database passwords or API keys/tokens, for example: Data stores defined with [parameterized catalog settings][catalog] (-DALLOWENVPARAMETRIZATION=true) which need a password or access key. GeoServer's official Docker image [uses environment variables to configure PostgreSQL JNDI resources, including credentials][docker-jndi] (POSTGRESHOST, POSTGRESUSERNAME, POSTGRESPASSWORD) Additionally, many community-developed GeoServer container images export other credentials from their start-up scripts as environment variables to the GeoServer (java) process, such as: GeoServer admin and master (root) passwords Tomcat management application password HTTPS/TLS certificate key store password AWS S3 bucket…
Recommended action: Upgrade to 2.25.1 or 2.24.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting (XSS) vulnerability exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources or in a specially crafted datastore file that will execute in the context of another user's browser when viewed in the Style Publisher. Access to the Style Publisher is available to all users although data security may limit users' ability to trigger the XSS. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Impact If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: 1 .Perform any action within the application that the user can perform. 2. View any information that the user is able to view. 3.…
Recommended action: Upgrade to 2.23.3 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Impact The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. Patches The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 2.19.6. Workarounds Protection can be achieved by making the GUI (geoserver/web), the REST configuration (geoserver/rest) and the embedded GeoWebCache configuration (geoserver/gwc/rest) unreachable from remote hosts, in addition to protecting access to the file system where the GeoServer configuration is stored.
Recommended action: Upgrade to 2.20.4 or 2.19.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.