Vulnerability · Published Oct 24, 2023 · Assigned by GitHub_M

CVE-2023-41339Unsecured WMS dynamic styling sld=<url> parameter affords blind unauthenticated SSRF in GeoServer

High 8.6

In plain English

A high-severity server-side request forgery in geoserver from geoserver. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.6High

Exploit odds (30 days)0.6%top 49.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an ``sld=<url>`` parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. This vulnerability can be used to steal user NetNTLMv2 hashes which could be relayed or cracked externally to gain further access. This vulnerability has been patched in versions 2.22.5 and 2.23.2.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Maven	org.geoserver.web:gs-web-app	2.22.5	GHSA-cqpc-x2c6-2gmf
Maven	org.geoserver.web:gs-web-app	2.23.2	GHSA-cqpc-x2c6-2gmf
Maven	org.geoserver:gs-wms	2.22.5	GHSA-cqpc-x2c6-2gmf
Maven	org.geoserver:gs-wms	2.23.2	GHSA-cqpc-x2c6-2gmf

Affected products (as reported)

Vendor	Product	Versions
geoserver	geoserver	< 2.22.5>= 2.23.0, < 2.23.2

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L

References

https://github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmf x_refsource_CONFIRM
https://github.com/geoserver/geoserver/releases/tag/2.22.5 x_refsource_MISC
https://github.com/geoserver/geoserver/releases/tag/2.23.2 x_refsource_MISC