Vulnerability · Published Aug 24, 2023 · Assigned by GitHub_M

CVE-2023-40017Geonode Server Side Request Forgery vulnerability

High 7.5

In plain English

A high-severity server-side request forgery in geonode from GeoNode. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 56% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.5High

Exploit odds (30 days)0.8%top 44.4% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. In versions 3.2.0 through 4.1.2, the endpoint `/proxy/?url=` does not properly protect against server-side request forgery. This allows an attacker to port scan internal hosts and request information from internal hosts. A patch is available at commit a9eebae80cb362009660a1fd49e105e7cdb499b9.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
PyPI	geonode	4.2.0	GHSA-rmxg-6qqf-x8mr
PyPI	geonode	4.1.3	PYSEC-2023-269

Affected products (as reported)

Vendor	Product	Versions
GeoNode	geonode	>= 3.2.0, <= 4.1.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References

https://github.com/GeoNode/geonode/security/advisories/GHSA-rmxg-6qqf-x8mr x_refsource_CONFIRM
https://github.com/GeoNode/geonode/commit/a9eebae80cb362009660a1fd49e105e7cdb499b9 x_refsource_MISC