CVE-2024-40625: GeoServer Coverage REST API Allows Server Side Request Forgery
Summary
The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allow to upload file with a specified url (with {method} equals 'url') with no restrict.
Details
The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allow to upload file with a specified url (with {method} equals 'url'). But this url has not been check with URL Checks feature.
For example, should add the code below to check fileURL:
java URLCheckers.confirm(fileURL)
The vulnerable code was RESTUtils.java
Impact
This vulnerability presents the opportunity for Server Side Request Forgery.
References
- https://osgeo-org.atlassian.net/browse/GEOS-11468 - https://osgeo-org.atlassian.net/browse/GEOS-11717
Other sources
GeoServer is an open source server that allows users to share and edit geospatial data. The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allows attackers to upload files with a specified url (with {method} equals 'url') with no restrict. This vulnerability is fixed in 2.26.0.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-40625?
CVE-2024-40625 has been classified with a significant severity level due to its potential for unrestricted file uploads.
How do I fix CVE-2024-40625?
To fix CVE-2024-40625, upgrade to versions of the affected packages higher than 2.26.0 that contain the security patch.
What software is affected by CVE-2024-40625?
CVE-2024-40625 affects the org.geoserver.web:gs-web-app and org.geoserver:gs-rest packages, specifically versions below 2.26.0.
What is the impact of CVE-2024-40625?
The impact of CVE-2024-40625 includes the potential for attackers to exploit unrestricted file uploads, leading to data breaches or system compromises.
Is there a workaround for CVE-2024-40625?
While the recommended solution is to upgrade, a temporary workaround may involve restricting access to the API endpoints until a secure version is deployed.