CVE-2022-24816: OSGeo GeoServer JAI-EXT Code Injection Vulnerability
Impact Programs using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project.
Patches Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script.
Workarounds Negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
References None.
Other sources
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
— MITRE
OSGeo GeoServer JAI-EXT contains a code injection vulnerability that, when programs use jt-jiffle and allow Jiffle script to be provided via network request, could allow remote code execution.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/it.geosolutions.jaiext.jiffle:jt-jiffle-languageto a version that resolves this vulnerability.Fixed in 1.1.22 - Upgrade
Upgrade
maven/it.geosolutions.jaiext.jiffle:jt-jiffleto a version that resolves this vulnerability.Fixed in 1.1.22 - Configuration
Remove janino-x.y.z.jar from the application's classpath to negate the ability to compile Jiffle scripts from the final application.
classpath (janino-x.y.z.jar) janino_present = false - Compensating control
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Event History
Frequently Asked Questions
What is the impact of CVE-2022-24816?
Programs using jt-jiffle and allowing Jiffle script to be provided via network request are susceptible to Remote Code Execution.
Which project is particularly affected by CVE-2022-24816?
The downstream GeoServer project is particularly affected by this vulnerability.
How can I fix CVE-2022-24816?
Update the jt-jiffle and jt-jiffle-language packages to version 1.1.23 or higher.
Where can I find more information about CVE-2022-24816?
More information about CVE-2022-24816 can be found in the GitHub security advisory and NVD NIST vulnerability report.
What is the severity rating of CVE-2022-24816?
The severity rating of CVE-2022-24816 is critical with a score of 9.8.