Potential Security Vulnerability in GeoServer Prior to Versions 2.23.5 and 2.24.3

CVE-2024-24749

What is CVE-2024-24749?

GeoServer, an open source server for sharing and editing geospatial data, is vulnerable to an input validation bypass when deployed on Windows with Apache Tomcat, prior to versions 2.23.5 and 2.24.3. This flaw enables unauthorized access to arbitrary classpath resources through the ByteStreamController class in GeoWebCache. If the server is installed using an embedded data directory from the geoserver.war file, there is a potential risk of reading sensitive resources, which could lead to unauthorized administrator access. While production environments typically utilize an external data directory, the vulnerability poses a risk to deployments with improper configurations. Security patches are available in the latest releases, and users are recommended to consider workarounds such as switching to a Linux environment or using Jetty as the application server.

References