GHSA-wf6j-gr27-g7ch CVE-2024-45747
GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
- Severity
- 7.2 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-749 Exposed Dangerous Method or Function
- Fix
- Available
- 3 packages have a fixed version
Description
Summary
A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a plain GeoServer instance (no extension or community modules) for WMS GetFeatureInfo HTML and JSON and WMS GetMap KML and GeoRSS output formats.
Details
The org.geoserver.template.TemplateUtils.getSafeConfiguration() method attempts to block access to the class freemarker.template.utility.Execute but it is still possible to gain access to it and other sensitive functionality by chaining a specific sequence of method calls.
Impact
This vulnerability can lead to executing arbitrary code and reading and writing arbitrary files.
Resolution
GeoServer 2.27.0 addresses this vulnerability with several new application properties:
GEOSERVER_FREEMARKER_BLOCK_LISTGEOSERVER_FREEMARKER_ALLOW_LISTGEOSERVER_FREEMARKER_API_EXPOSED
These application properties default to restricting the objects template authors can access, and limit access to "getter" methods used to access object properties.
Affected versions
Maven
| Package | Vulnerable | Fixed in |
|---|---|---|
| org.geoserver.web:gs-web-app | < 2.27.0 |
2.27.0 |
| org.geoserver:gs-main | < 2.27.0 |
2.27.0 |
| org.geoserver:gs-wms | < 2.27.0 |
2.27.0 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
org.geoserver.web:gs-web-app Maven → 2.27.0
- maven
<dependency><groupId>org.geoserver.web</groupId><artifactId>gs-web-app</artifactId><version>2.27.0</version></dependency>- gradle
implementation("org.geoserver.web:gs-web-app:2.27.0")
org.geoserver:gs-main Maven → 2.27.0
- maven
<dependency><groupId>org.geoserver</groupId><artifactId>gs-main</artifactId><version>2.27.0</version></dependency>- gradle
implementation("org.geoserver:gs-main:2.27.0")
org.geoserver:gs-wms Maven → 2.27.0
- maven
<dependency><groupId>org.geoserver</groupId><artifactId>gs-wms</artifactId><version>2.27.0</version></dependency>- gradle
implementation("org.geoserver:gs-wms:2.27.0")
Severity breakdown
CVSS 3.1 7.2
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- High
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-749: Exposed Dangerous Method or Function
The product provides an Applications Programming Interface (API) or similar interface for interaction with external actors, but the interface includes a dangerous method or function that is not properly restricted.
How to prevent it
- Architecture and Design: If you must expose a method, make sure to perform input validation on all arguments, limit access to authorized parties, and protect against all possible vulnerabilities.
- Architecture and Design, Implementation: Identify all exposed functionality. Explicitly list all functionality that must be exposed to some user or set of users. Identify which functionality may be: accessible to all users restricted to a small set of privileged users prevented from being directly accessible at all Ensure that the implemented code follows these expectations. This includes setting the appropriate access modifiers where applicable (public, private, protected, etc.) or not marking ActiveX controls safe-for-scripting.
References
Packages
Other links
Timeline
- Published
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-fjf5-xgmq-5525 GeoServer is vulnerable to Unauthenticated XML External Entities (XXE) attack via WMS GetMap feature | Critical Known exploited | Also affects org.geoserver:gs-wms |
| GHSA-6jj6-gm7p-fcvv Remote Code Execution (RCE) vulnerability in geoserver | Critical Known exploited | Also affects org.geoserver:gs-wms |
| GHSA-x4r9-gmw3-hxww GeoServer has a Server-Side Request Forgery (SSRF) Vulnerability in its XML Entity Resolution | High | Also affects org.geoserver:gs-main |
| GHSA-7qmg-grcp-qf25 GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page | High | Also affects org.geoserver.web:gs-web-app |
| GHSA-w66h-j855-qr72 GeoServer has a Reflected Cross-Site Scripting (XSS) vulnerability in its WMS GetFeatureInfo HTML format | Medium | Also affects org.geoserver:gs-wms |
| GHSA-jj54-8f66-c5pc [XBOW-025-068] XML External Entity (XXE) Processing Vulnerability in GeoServer WFS Service | Critical | Also affects org.geoserver.web:gs-web-app |
| GHSA-gr67-pwcv-76gf GeoServer Infinite Loop Vulnerability in Jiffle process | High | Also affects org.geoserver:gs-wms |
| GHSA-h86g-x8mm-78m5 GeoServer Missing Authorization on REST API Index | Medium | Also affects org.geoserver.web:gs-web-app |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor