Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

Maven package

org.geoserver:gs-platform

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

1 actionable advisory, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. High, CVSS 7.2MavenPublished

    Arbitrary file upload vulnerability in GeoServer's REST Coverage Store API

    CVE-2023-51444 · GHSA-9v5q-2gwq-q9hq

    Affected
    • Maven org.geoserver:gs-platform < 2.23.4; >= 2.24.0, <= 2.24.0
    Fixed in
    2.23.42.24.1· Vendor fix available
    Issue
    An arbitrary file upload vulnerability exists that enables an authenticated administrator with permissions to modify coverage stores through the REST Coverage Store API to upload arbitrary file contents to arbitrary file locations which can lead to remote code execution. Details Coverage stores that are configured using relative paths use a GeoServer Resource implementation that has validation to prevent path traversal but coverage stores that are configured using absolute paths use a different Resource implementation that does not prevent path traversal. PoC Step 1 (create sample coverage store): curl -vXPUT -H"Content-type:application/zip" -u"admin:geoserver" --data-binary @polyphemus.zip "http://localhost:8080/geoserver/rest/workspaces/sf/coveragestores/filewrite/file.imagemosaic" Step 2 (switch store to absolute URL): curl -vXPUT -H"Content-Type:application/xml" -u"admin:geoserver" -d"<coverageStore<urlfile:///{absolute path to data…

    Recommended action: Upgrade to 2.24.1 or 2.23.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →