SB2023102471 - Multiple vulnerabilities in geoserver

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2023102471

SB2023102471 - Multiple vulnerabilities in geoserver

Published: October 24, 2023 Updated: May 5, 2026

Security Bulletin ID SB2023102471
CSH Severity
High
Patch available
YES
Number of vulnerabilities 10
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 20% Low 80%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 10 vulnerabilities.


1) Arbitrary file upload (CVE-ID: CVE-2023-51444)

CWE-ID: CWE-434 - Unrestricted Upload of File with Dangerous Type

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper input validation in the REST Coverage Store API when handling file upload requests for coverage stores configured with absolute paths. A remote privileged user can upload arbitrary file contents to arbitrary file locations to execute arbitrary code.

An attacker with permissions to modify coverage stores may also overwrite GeoServer security files to obtain full administrator privileges.


2) Cross-site scripting (CVE-ID: CVE-2024-23643)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in another administrator's browser.

The vulnerability exists due to cross-site scripting in the GWC Seed Form when rendering catalog data stored in the GeoServer catalog. A remote privileged user can store a JavaScript payload that is executed when another administrator views the form to execute arbitrary script in another administrator's browser.

User interaction is required, and the payload executes in the context of the victim administrator's browser.


3) Cross-site scripting (CVE-ID: CVE-2024-23821)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in another user's browser.

The vulnerability exists due to cross-site scripting in the GWC Demos Page when rendering catalog data from the GeoServer catalog. A remote privileged user can store a JavaScript payload in the catalog to execute arbitrary script in another user's browser.

User interaction is required to view the GWC Demos Page, and access to that page is available to all users although data security may limit users' ability to trigger the issue.


4) Cross-site scripting (CVE-ID: CVE-2024-23819)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in the MapML HTML Page when rendering catalog content. A remote privileged user can store a malicious JavaScript payload in the GeoServer catalog to execute arbitrary script in a victim's browser.

User interaction is required to view the MapML HTML Page, and the MapML extension must be installed.


5) Cross-site scripting (CVE-ID: CVE-2024-23818)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in another user's browser.

The vulnerability exists due to cross-site scripting in the WMS GetMap OpenLayers output format when rendering catalog content containing a stored JavaScript payload. A remote privileged user can store a crafted JavaScript payload in the GeoServer catalog to execute arbitrary script in another user's browser.

User interaction is required to view the WMS GetMap OpenLayers output format.


6) Cross-site scripting (CVE-ID: CVE-2024-23642)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary JavaScript in another user's browser.

The vulnerability exists due to cross-site scripting in the Simple SVG renderer when rendering the WMS GetMap SVG output format. A remote privileged user can store a JavaScript payload in the GeoServer catalog to execute arbitrary JavaScript in another user's browser.

User interaction is required to view the crafted SVG output, and the issue is exposed only when the Simple SVG renderer is enabled.


7) Cross-site scripting (CVE-ID: CVE-2024-23640)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script in a victim's browser.

The vulnerability exists due to cross-site scripting in the Style Publisher when rendering uploaded style or legend resources or a specially crafted datastore file. A remote privileged user can store a JavaScript payload to execute arbitrary script in a victim's browser.

User interaction is required when another user views the malicious content in the Style Publisher.


8) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2023-43795)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to perform server-side request forgery.

The vulnerability exists due to improper access control in the OGC Web Processing Service (WPS) Execute operation when processing complex remote inputs from external URL references. A remote attacker can submit a crafted request referencing an external URL to perform server-side request forgery.

Exploitation requires the WPS extension to be installed, the "Disable complex inputs" setting to be unselected, and security URL checks to be disabled.


9) Cross-site scripting (CVE-ID: CVE-2023-51445)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary JavaScript in another administrator's browser.

The vulnerability exists due to cross-site scripting in the REST Resources API when viewing uploaded style or legend resources. A remote privileged user can upload a specially crafted resource file to execute arbitrary JavaScript in another administrator's browser.

User interaction is required, and the payload executes when another administrator views the stored file through the API.


10) Server-Side Request Forgery (SSRF) (CVE-ID: CVE-2023-41339)

CWE-ID: CWE-918 - Server-Side Request Forgery (SSRF)

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to server-side request forgery in the WMS endpoint when processing user-supplied sld URL parameters in GetMap, GetLegendGraphic, or GetFeatureInfo requests. A remote attacker can send a specially crafted request to disclose sensitive information.

Exploitation requires dynamic styling to be enabled and URL checks to be disabled or configured to allow file access.


Remediation

Install update from vendor's website.

References