Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
9 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a plain GeoServer instance (no extension or community modules) for WMS GetFeatureInfo HTML and JSON and WMS GetMap KML and GeoRSS output formats. Details The org.geoserver.template.TemplateUtils.getSafeConfiguration() method attempts to block access to the class freemarker.template.utility.Execute but it is still possible to gain access to it and other sensitive functionality by chaining a specific sequence of method calls. Impact This vulnerability can lead to executing arbitrary code and reading and writing arbitrary files. Resolution GeoServer 2.27.0 addresses this vulnerability with several new application properties: GEOSERVERFREEMARKERBLOCKLIST GEOSERVERFREEMARKERALLOWLIST…
Recommended action: Upgrade to 2.27.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
An XML External Entity (XXE) vulnerability was identified. The application accepts XML input through a specific endpoint /geoserver/wms operation GetMap. However, this input is not sufficiently sanitized or restricted, allowing an attacker to define external entities within the XML request. An XML External Entity attack is a type of attack that occurs when XML input containing a reference to an external entity is processed by a weakly configured XML parser. This attack may lead to the disclosure of confidential data, denial of service, port scanning from the perspective of the machine where the parser is located, and other system impacts. By exploiting this vulnerability, an attacker can: - Read arbitrary files from the server's file system. - Conduct Server-Side Request Forgery (SSRF) to interact with internal systems. - Execute Denial of Service (DoS) attacks by exhausting resources. Resolution Update to GeoServer 2.25.6, GeoServer 2.26.3, or GeoServer 2.27.0. Impact…
Recommended action: Upgrade to 2.26.2 or 2.25.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A reflected cross-site scripting (XSS) vulnerability exists in the WMS GetFeatureInfo HTML output format that enables a remote attacker to execute arbitrary JavaScript code in a victim's browser through specially crafted SLDBODY parameters. Details The WMS service setting that controls HTML auto-escaping is either disabled by default, or completely missing, in the affected versions (see workarounds). Impact If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: 1. Perform any action within the application that the user can perform. 2. View any information that the user is able to view. 3. Modify any information that the user is able to modify. 4. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user. Workarounds Changing any of the following WMS service settings should mitigate…
Recommended action: Upgrade to 2.25.0 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Malicious Jiffle scripts can be executed by GeoServer, either as a rendering transformation in WMS dynamic styles or as a WPS process, that can enter an infinite loop to trigger denial of service. Details The Jiffle language supports multiple loop constructs that will cause its code block to be continuously executed until a certain condition is met. The Jiffle runtime should be updated to throw an exception if the script exceeds a certain number of loop iterations. Impact This vulnerability allows attackers to conduct denial-of-service attacks. Mitigation This vulnerability can be mitigated by disabling WMS dynamic styling (see WMS Settings). If the WPS extension is installed, the Jiffle process must also be disabled to mitigate this vulnerability (see WPS Settings) References https://github.com/geosolutions-it/jai-ext/pull/307 https://osgeo-org.atlassian.net/browse/GEOS-11778
Recommended action: Upgrade to 2.26.3 or 2.25.7 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. Details The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to ALL GeoServer instances. PoC No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. Impact This vulnerability can lead to executing arbitrary code.…
Recommended action: Upgrade to 2.25.2, 2.24.4, 2.23.6 or 2.22.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting (XSS) vulnerability exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap OpenLayers Output Format. Access to the WMS OpenLayers Format is available to all users by default although data and service security may limit users' ability to trigger the XSS. Impact If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: 1 .Perform any action within the application that the user can perform. 2. View any information that the user is able to view. 3. Modify any information that the user is able to modify. 4. Initiate interactions with other application users, including malicious attacks, that will appear to originate from the initial victim user. References…
Recommended action: Upgrade to 2.24.1 or 2.23.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A stored cross-site scripting (XSS) vulnerability exists that enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in the GeoServer catalog that will execute in the context of another user's browser when viewed in the WMS GetMap SVG Output Format when the Simple SVG renderer is enabled. Access to the WMS SVG Format is available to all users by default although data and service security may limit users' ability to trigger the XSS. Details Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer. PoC Complete instructions, including specific configuration details, to reproduce the vulnerability. Impact If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: 1 .Perform any action within the application that the user can perform. 2. View any information that the…
Recommended action: Upgrade to 2.24.1 or 2.23.4 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The WMS specification defines an sld=<url parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. It is possible to use this for "Blind SSRF" on the WMS endpoint to steal NetNTLMv2 hashes via file requests to malicious servers. Details This vulnerability requires: WMS Settings dynamic styling being enabled Security URL checks to be disabled, or to be enabled and allowing file:\\ access Impact This vulnerability can be used to steal user NetNTLMv2 hashes which could be relayed or cracked externally to gain further access. Mitigation The ability to reference an external URL location is defined by the WMS standard GetMap, GetFeatureInfo and GetLegendGraphic operations. These operations are defined by an Industry and International standard and cannot be redefined by the GeoServer application in…
Recommended action: Upgrade to 2.23.2 or 2.22.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. RCE in Jiffle The Jiffle map algebra language, provided by jai-ext, allows efficiently execute map algebra over large images. A vulnerability CVE-2022-24816 has been recently found in Jiffle, that allows a Code Injection to be performed by properly crafting a Jiffle invocation. In the case of GeoServer, the injection can be performed from a remote request. Assessment GeoTools includes the Jiffle language as part of the gt-process-raster-<version module, applications using it should check whether it’s possible to provide a Jiffle script from remote, and if so, upgrade or remove the functionality (see also the GeoServer mitigation, below). The issue is of particular interest for GeoServer users, as GeoServer embeds Jiffle in the base WAR package. Jiffle is available as a OGC…
Recommended action: Upgrade to 2.20.4, 2.19.6 or 2.18.6 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.