CVE-2024-23642

Executive Summary

CVE-2024-23642 is a stored cross-site scripting (XSS) vulnerability in GeoServer, an open-source server for sharing geospatial data. An authenticated administrator with workspace-level privileges can inject a JavaScript payload into the GeoServer catalog. This payload executes in the context of another user's browser when viewing a WMS GetMap request in SVG Output Format with the Simple SVG renderer enabled. The vulnerability affects versions prior to 2.23.4 and 2.24.1. The CVSS score is 4.8 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood. No public proof-of-concept (POC) or exploit code is available. The fix is to upgrade to the patched versions.

Supply Chain & Package Security

GeoServer is a Java-based application distributed as a WAR file or via Docker. The vulnerability is in the core application code, not in a third-party package. Users should verify the integrity of the downloaded WAR file or Docker image using checksums provided by the GeoServer project.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
• Base Score: 4.8 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: High (PR:H) – requires admin with workspace-level privileges
• User Interaction: Required (UI:R) – victim must view the SVG output
• Scope: Unchanged (S:U)
• Confidentiality Impact: Low (C:L)
• Integrity Impact: Low (I:L)
• Availability Impact: Low (A:L)

Threat Level: Medium. The vulnerability requires authenticated admin access and user interaction, limiting its impact. However, it can lead to session hijacking, data theft, or defacement within the GeoServer context.

Deep Dive & Mechanics

The vulnerability exists in the WMS GetMap SVG Output Format when the Simple SVG renderer is enabled. GeoServer stores metadata (e.g., layer names, styles) in its catalog. An authenticated administrator with workspace-level privileges can inject a JavaScript payload into this metadata (e.g., via a malicious layer name or style). When another user requests a map in SVG format, the server embeds this metadata into the SVG output without proper sanitization. The victim's browser then executes the injected script.

Root Cause: Insufficient output encoding of user-controlled data in the SVG rendering pipeline. The Simple SVG renderer does not escape HTML/JavaScript characters before embedding them in the SVG document.

Attack Flow:

1. Attacker (admin) logs into GeoServer.
2. Attacker creates or modifies a workspace resource (e.g., layer, style) with a malicious payload in a metadata field (e.g., <script>alert('XSS')</script>).
3. Attacker waits for or lures a victim (another user) to access a WMS GetMap request with format=image/svg+xml and the malicious layer.
4. Victim's browser renders the SVG, executing the injected script.

Vulnerable vs. Patched Code

Vulnerable Code (Simplified):

// In SVG renderer, metadata is directly concatenated
String svgOutput = "<svg><text>" + metadataValue + "</text></svg>";

Patched Code (Simplified):

// Properly encode the metadata value
String encodedValue = StringEscapeUtils.escapeHtml4(metadataValue);
String svgOutput = "<svg><text>" + encodedValue + "</text></svg>";

The patch uses HTML entity encoding to neutralize script injection. The exact fix is in the GeoServer source code, specifically in the SVG output format handler.

Exploitation & Lab Setup

Red Team

Prerequisites:

• GeoServer instance (version < 2.23.4 or < 2.24.1)
• Admin credentials with workspace-level privileges
• WMS SVG format enabled (default)

Steps:

1. Log in as admin.
2. Navigate to a workspace and create a new layer or style.
3. In a metadata field (e.g., "Title"), inject a JavaScript payload:

   <script>alert('XSS')</script>
   

4. Save the resource.
5. Craft a WMS GetMap URL:

   http://target/geoserver/wms?service=WMS&version=1.1.0&request=GetMap&layers=workspace:malicious_layer&format=image/svg+xml
   

6. Send the URL to the victim (e.g., via email or social engineering).

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team

Detection:

• Monitor GeoServer logs for unusual metadata changes by admin users.
• Look for WMS GetMap requests with format=image/svg+xml and suspicious layer names.
• Use web application firewalls (WAF) to block malicious payloads in SVG output.

Hunting:

• Search for <script> tags in GeoServer catalog database (e.g., PostgreSQL, H2).
• Review recent admin actions for unauthorized metadata modifications.

Indicators of Compromise (IOCs)

• Network: WMS GetMap requests with format=image/svg+xml and unusual layer names.
• File: GeoServer log entries showing admin metadata changes with script-like content.
• Database: Rows in the GeoServer catalog containing <script> or onerror attributes.
• Behavior: Unexpected JavaScript execution in GeoServer web interface when viewing SVG maps.

Detection Engineering

YARA Rule

rule GeoServer_XSS_SVG_Payload {
    meta:
        description = "Detects potential XSS payload in GeoServer SVG output"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23642"
    strings:
        $svg_tag = "<svg"
        $script_tag = "<script"
        $onerror = "onerror="
        $onload = "onload="
    condition:
        $svg_tag and ($script_tag or $onerror or $onload)
}

Sigma Rule

title: GeoServer Stored XSS via SVG Output
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential XSS payload in GeoServer WMS SVG responses
author: Valters IT
logsource:
    category: web
    product: geoserver
detection:
    selection:
        response.body|contains: 
            - "<script>"
            - "onerror="
            - "onload="
        request.url|contains: "format=image/svg+xml"
    condition: selection
falsepositives:
    - Legitimate use of SVG with JavaScript (rare)
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-23642 GeoServer XSS in SVG Output"; flow:to_server,established; content:"format=image/svg+xml"; http_uri; content:"<script"; http_server_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade GeoServer to version 2.23.4 or 2.24.1.
• If upgrade is not possible, disable the WMS SVG Output Format:
  • In GeoServer web admin, go to Services > WMS > Output Formats and uncheck "SVG".
• Restrict admin access to trusted users only.

Long-term:

• Implement input validation and output encoding for all user-controlled data.
• Use Content Security Policy (CSP) headers to mitigate XSS.
• Regularly audit GeoServer logs and catalog for suspicious changes.

Valters IT Signature

This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.