CVE-2024-32037

Executive Summary

CVE-2024-32037 is an information disclosure vulnerability in Osgeo GeoNetwork, a catalog application for managing spatially referenced resources. The vulnerability exists in versions prior to 4.2.10 and 4.4.5. The search end-point response headers contain information about the Elasticsearch software in use, which can be used by attackers to identify the software version and potentially target known vulnerabilities. This is a low-severity issue with no known public exploits, but it is important to patch to reduce the attack surface.

Supply Chain & Package Security

GeoNetwork is a Java-based application that uses Elasticsearch as a search backend. The vulnerability is in the application code, not in the Elasticsearch software itself. The fix is to upgrade to the latest patched versions.

CVSS Breakdown & Threat Level

The CVSS score is 0.0, indicating no immediate threat. However, the vulnerability is classified as CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). The EPSS score is 0.0%, meaning no active exploitation in the wild. The threat level is low, but patching is recommended to prevent information gathering.

Deep Dive & Mechanics

The vulnerability is in the search end-point of GeoNetwork. When a search request is made, the response headers include information about the Elasticsearch software version. This is due to the application not sanitizing or removing the Elasticsearch version information from the response headers. An attacker can send a simple HTTP request to the search end-point and observe the headers to determine the Elasticsearch version. This information can be used to identify known vulnerabilities in that specific version of Elasticsearch.

Vulnerable vs. Patched Code

The vulnerable code is in the search end-point handler. The patched code removes the Elasticsearch version information from the response headers.

Vulnerable Code (Conceptual):

// In the search response handler
response.setHeader("X-Elasticsearch-Version", elasticsearchVersion);

Patched Code (Conceptual):

// In the search response handler
// Remove the header
response.removeHeader("X-Elasticsearch-Version");

Exploitation & Lab Setup

Red Team

1. Setup: Deploy a vulnerable GeoNetwork instance (version < 4.2.10 or < 4.4.5) with Elasticsearch backend.
2. Reconnaissance: Send a GET request to the search end-point:

   curl -v http://target/geonetwork/srv/eng/search
   

3. Exploitation: Observe the response headers for Elasticsearch version information:

   HTTP/1.1 200 OK
   X-Elasticsearch-Version: 7.10.2
   

4. Post-Exploitation: Use the version information to search for known vulnerabilities in that Elasticsearch version.

Blue Team

1. Detection: Monitor for requests to the search end-point and inspect response headers for Elasticsearch version information.
2. Mitigation: Upgrade to GeoNetwork 4.2.10 or 4.4.5.
3. Workaround: If patching is not immediately possible, configure a reverse proxy (e.g., Nginx) to remove the X-Elasticsearch-Version header from responses.

Indicators of Compromise (IOCs)

• Network: HTTP responses containing X-Elasticsearch-Version header.
• Logs: Access logs showing requests to /geonetwork/srv/eng/search or similar search end-points.

Detection Engineering

YARA Rule

rule Detect_GeoNetwork_Elasticsearch_Version_Disclosure {
    meta:
        description = "Detects GeoNetwork responses containing Elasticsearch version information"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-32037"
    strings:
        $header = "X-Elasticsearch-Version:"
    condition:
        $header
}

Sigma Rule

title: GeoNetwork Elasticsearch Version Disclosure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP responses from GeoNetwork that contain Elasticsearch version information
author: Valters IT
date: 2024/01/01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-32037
logsource:
    category: webserver
    product: apache
detection:
    selection:
        response_headers|contains: "X-Elasticsearch-Version"
    condition: selection
falsepositives:
    - Legitimate GeoNetwork responses
level: low

Suricata Rule

alert http any any -> any any (msg:"GeoNetwork Elasticsearch Version Disclosure"; flow:to_client; content:"X-Elasticsearch-Version"; http_header; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate: Upgrade to GeoNetwork 4.2.10 or 4.4.5.
2. Workaround: Configure a reverse proxy to remove the X-Elasticsearch-Version header.
3. Long-term: Implement a security policy to review and sanitize response headers in all applications.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert