Potential Security Vulnerability in GeoServer Prior to Versions 2.23.5 and 2.24.3
CVE-2024-24749

7.5HIGH

Key Information:

Vendor

Geoserver

Status
Geoserver
Vendor
CVE Published:
1 July 2024

What is CVE-2024-24749?

GeoServer, an open source server for sharing and editing geospatial data, is vulnerable to an input validation bypass when deployed on Windows with Apache Tomcat, prior to versions 2.23.5 and 2.24.3. This flaw enables unauthorized access to arbitrary classpath resources through the ByteStreamController class in GeoWebCache. If the server is installed using an embedded data directory from the geoserver.war file, there is a potential risk of reading sensitive resources, which could lead to unauthorized administrator access. While production environments typically utilize an external data directory, the vulnerability poses a risk to deployments with improper configurations. Security patches are available in the latest releases, and users are recommended to consider workarounds such as switching to a Linux environment or using Jetty as the application server.

Affected Version(s)

geoserver < 2.23.5 < 2.23.5

geoserver >= 2.24.0, < 2.24.3 < 2.24.0, 2.24.3

References

https://github.com/geoserver/geoserver/security/advisorie...
x_refsource_CONFIRM
https://github.com/GeoWebCache/geowebcache/pull/1211
x_refsource_MISC
https://github.com/GeoWebCache/geowebcache/commit/c7f76bd...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2024-24749 : Potential Security Vulnerability in GeoServer Prior to Versions 2.23.5 and 2.24.3