CVE-2023-41877: GeoServer log file path traversal vulnerability
Impact
This vulnerability requires GeoServer Administrator with access to the admin console to misconfigured the Global Settings for log file location to an arbitrary location.
This can be used to read files via the admin console GeoServer Logs page. It is also possible to leverage RCE or cause denial of service by overwriting key GeoServer files.
Patches
As this issue requires GeoServer administrators access, often representing a trusted party, the vulnerability has not yet attracted a volunteer or resources.
Interested parties are welcome to contact geoserver-security@lists.osgeo.org for recommendations on developing a fix.
Workarounds
A system administrator responsible for running GeoServer can define the GEOSERVERLOGFILE parameter, preventing the global setting provided from being used.
The GEOSERVERLOGLOCATION parameter can be set as system property, environment variable, or servlet context parameter.
Environmental variable: bash export GEOSERVERLOGLOCATION=/var/opt/geoserver/logs
System property: bash -DGEOSERVERLOGLOCATION=/var/opt/geoserver/logs
Web application WEB-INF/web.xml: xml <context-param> <param-name> GEOSERVERLOGLOCATION </param-name> <param-value>/var/opt/geoserver/logs</param-value> </context-param>
Tomcat conf/Catalina/localhost/geoserver.xml: xml <Context> <Parameter name="GEOSERVERLOGLOCATION" value="/var/opt/geoserver/logs" override="false"/> </Context>
References
Log location (User Manual)
Other sources
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. A path traversal vulnerability in versions 2.23.4 and prior requires GeoServer Administrator with access to the admin console to misconfigure the Global Settings for log file location to an arbitrary location. The admin console GeoServer Logs page provides a preview of these contents. As this issue requires GeoServer administrators access, often representing a trusted party, the vulnerability has not received a patch as of time of publication. As a workaround, a system administrator responsible for running GeoServer can use the GEOSERVERLOGFILE setting to override any configuration option provided by the Global Settings page. The GEOSERVERLOGLOCATION parameter can be set as system property, environment variables, or servlet context parameters.
— NVD
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2023-41877?
CVE-2023-41877 is considered a high-severity vulnerability due to its ability to expose sensitive files through misconfigured log file locations.
How do I fix CVE-2023-41877?
To fix CVE-2023-41877, ensure that the log file location in the Global Settings of GeoServer is configured correctly to a secure directory.
Who is affected by CVE-2023-41877?
CVE-2023-41877 affects GeoServer versions up to and including 2.23.4, specifically instances with misconfigured log file locations.
What are the potential impacts of CVE-2023-41877?
The potential impact of CVE-2023-41877 includes unauthorized access to sensitive information contained in log files via the GeoServer admin console.
How can I identify if my GeoServer is vulnerable to CVE-2023-41877?
You can identify if your GeoServer is vulnerable to CVE-2023-41877 by checking the version and verifying the configuration of the Global Settings for log file locations.