CVE-2023-42439: GeoNode SSRF Bypass to return internal host data
A SSRF vulnerability exists, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network.
the application is using a whitelist, but the whitelist can be bypassed with @ and encoded value of @ (%40) GET /proxy/?url=http://development.demo.geonode.org%40geoserver:8080/geoserver/web This will trick the application that the first host is a whitelisted address, but the browser will use @ or %40 as a credential to the host geoserver on port 8080, this will return the data to that host on the response.
!image
Other sources
GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. The application is using a whitelist, but the whitelist can be bypassed. The bypass will trick the application that the first host is a whitelisted address, but the browser will use @ or %40 as a credential to the host geoserver on port 8080, this will return the data to that host on the response. Version 4.1.3.post1 is the first available version that contains a patch.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the CVE ID of this vulnerability?
The CVE ID of this vulnerability is CVE-2023-42439.
What is the severity of CVE-2023-42439?
The severity of CVE-2023-42439 is high with a CVSS score of 6.5.
What is the affected software?
The affected software is GeoNode version 3.2.0 up to 4.1.2.
What is the vulnerability description for CVE-2023-42439?
CVE-2023-42439 is a SSRF vulnerability in GeoNode that allows bypassing existing controls and can be used to request internal services for a full read SSRF, returning any data from the internal network.
How can I fix CVE-2023-42439?
To fix CVE-2023-42439, upgrade to GeoNode version 4.1.3 or later.