Skip to content
OpenAdvisories
Critical · 9.8 CVE-2023-35042 EUVD-2023-1696GHSA-59x6-g4jr-4hxc

GeoServer RCE due to improper control of generation of code in jai-ext`Jiffle` map algebra language

Published Jun 12, 2023 · Updated Nov 27, 2024 · Assigned by mitre

Package: org.geoserver:gs-wfs Package: org.geoserver:gs-wms Package: org.geoserver:gs-wps Ecosystem: Maven

Description

GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.geoserver:gs-wfs < 2.18.6 2.18.6 GHSA-59x6-g4jr-4hxc
Maven org.geoserver:gs-wfs >= 2.19.0, < 2.19.6 2.19.6 GHSA-59x6-g4jr-4hxc
Maven org.geoserver:gs-wfs >= 2.20.0, < 2.20.4 2.20.4 GHSA-59x6-g4jr-4hxc
Maven org.geoserver:gs-wms < 2.18.6 2.18.6 GHSA-59x6-g4jr-4hxc
Maven org.geoserver:gs-wms >= 2.19.0, < 2.19.6 2.19.6 GHSA-59x6-g4jr-4hxc
Maven org.geoserver:gs-wms >= 2.20.0, < 2.20.4 2.20.4 GHSA-59x6-g4jr-4hxc
Maven org.geoserver:gs-wps < 2.18.6 2.18.6 GHSA-59x6-g4jr-4hxc
Maven org.geoserver:gs-wps >= 2.19.0, < 2.19.6 2.19.6 GHSA-59x6-g4jr-4hxc
Maven org.geoserver:gs-wps >= 2.20.0, < 2.20.4 2.20.4 GHSA-59x6-g4jr-4hxc

References