Skip to content
Log inStart free trial

GHSA-cqpc-x2c6-2gmf CVE-2023-41339

Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF

Medium Maven
Severity
5.3 / 10
Medium · CVSS 3.1
Exploit chance (EPSS)
0.63%
Chance of exploitation in the next 30 days. Higher than 50.33% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-918 Server-Side Request Forgery (SSRF)
Fix
Available
2 packages have a fixed version

Description

Summary

The WMS specification defines an sld=<url> parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery.

It is possible to use this for "Blind SSRF" on the WMS endpoint to steal NetNTLMv2 hashes via file requests to malicious servers.

Details

This vulnerability requires:

  • WMS Settings dynamic styling being enabled
  • Security URL checks to be disabled, or to be enabled and allowing file:\\* access

Impact

This vulnerability can be used to steal user NetNTLMv2 hashes which could be relayed or cracked externally to gain further access.

Mitigation

The ability to reference an external URL location is defined by the WMS standard GetMap, GetFeatureInfo and GetLegendGraphic operations. These operations are defined by an Industry and International standard and cannot be redefined by the GeoServer application in isolation.

To disable dynamic styling on GeoServer 2.10.3 and GeoServer 2.11.1:

  1. Navigate to Services > WMS Settings page
  2. Locate Dynamic styling heading
  3. Select the Disable usage of SLD and SLD_BODY parameters in GET requests and user styles in POST checkbox.

Resolution

To allow dynamic styling safely on GeoServer 2.22.5 and GeoServer 2.23.2:

  1. Navigate to Security > URL Checks
  2. Enable URL Checks are enabled setting
  3. Check the user manual for examples of how to trust specific locations: ^https://styles\.server\.net/cartography/.*$
  4. Enable dynamic styling on the Services > WMS Settings page, deselect the Disable usage of SLD and SLD_BODY parameters in GET requests and user styles in POST checkbox.

Use of dynamic styling safely is on by default in GeoServer 2.24.0.

References

Affected versions

Maven

PackageVulnerableFixed in
org.geoserver.web:gs-web-app
< 2.22.5
2.22.5
org.geoserver.web:gs-web-app
>= 2.23.0, < 2.23.2
2.23.2
org.geoserver:gs-wms
< 2.22.5
2.22.5
org.geoserver:gs-wms
>= 2.23.0, < 2.23.2
2.23.2

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.geoserver.web:gs-web-app Maven → 2.22.5

maven
<dependency><groupId>org.geoserver.web</groupId><artifactId>gs-web-app</artifactId><version>2.22.5</version></dependency>
gradle
implementation("org.geoserver.web:gs-web-app:2.22.5")

org.geoserver:gs-wms Maven → 2.22.5

maven
<dependency><groupId>org.geoserver</groupId><artifactId>gs-wms</artifactId><version>2.22.5</version></dependency>
gradle
implementation("org.geoserver:gs-wms:2.22.5")

Severity breakdown

CVSS 3.1 5.3

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
None
Availability
None

Weakness

CWE-918: Server-Side Request Forgery (SSRF)

The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-fjf5-xgmq-5525
GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature
Critical Known exploited Also affects org.geoserver:gs-wms
GHSA-6jj6-gm7p-fcvv
Remote Code Execution (RCE) vulnerability in geoserver
Critical Known exploited Also affects org.geoserver:gs-wms
GHSA-wf6j-gr27-g7ch
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
High Also affects org.geoserver:gs-wms
GHSA-x4r9-gmw3-hxww
GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution
High Also affects org.geoserver.web:gs-web-app
GHSA-7qmg-grcp-qf25
GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page
High Also affects org.geoserver.web:gs-web-app
GHSA-w66h-j855-qr72
GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format
Medium Also affects org.geoserver:gs-wms
GHSA-jj54-8f66-c5pc
[XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service
Critical Also affects org.geoserver.web:gs-web-app
GHSA-gr67-pwcv-76gf
GeoServer Infinite Loop Vulnerability in Jiffle process
High Also affects org.geoserver:gs-wms
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor