CVE-2024-35230

Executive Summary

CVE-2024-35230 is an information disclosure vulnerability in GeoServer, an open-source Java-based server for sharing and editing geospatial data. The vulnerability allows an unauthenticated attacker to retrieve sensitive version and revision information about the software and its components from the welcome and about pages. This information can be used to identify specific software versions, aiding in targeted attacks. The vulnerability has a CVSS score of 5.3 (Medium) and is patched in version 2.26.0. No public exploits or workarounds are currently available.

Supply Chain & Package Security

GeoServer is a Java application typically distributed as a WAR file or a standalone binary. The vulnerability does not directly affect package managers like NPM, PyPI, Go, or Ruby. However, organizations using GeoServer as part of a larger geospatial data pipeline should ensure that the software is updated to the patched version to prevent information leakage that could compromise the supply chain.

CVSS Breakdown & Threat Level

• CVSS Score: 5.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The vulnerability is considered medium severity due to the low confidentiality impact and the lack of direct impact on integrity or availability. However, the information disclosed can be used to facilitate more severe attacks.

Deep Dive & Mechanics

The vulnerability exists in the welcome and about pages of GeoServer. These pages are accessible without authentication and display version and revision information about the software, including library and component versions. An attacker can access these pages via HTTP requests to the root or /about endpoints.

The information disclosed includes:

• GeoServer version (e.g., 2.25.0)
• Build revision or commit hash
• Library versions (e.g., Spring, GeoTools, etc.)

This information allows an attacker to identify known vulnerabilities in specific versions of GeoServer or its dependencies, enabling targeted exploitation.

Vulnerable vs. Patched Code

Vulnerable Code (pre-2.26.0): The welcome and about pages include version information directly in the HTML response. For example, the welcome page might contain:

<div id="version">GeoServer 2.25.0</div>

Patched Code (2.26.0): The version information is removed from the welcome and about pages. The patched code either omits the version div or replaces it with a generic message.

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Deploy a vulnerable GeoServer instance (e.g., version 2.25.0) using Docker:

   docker run -d -p 8080:8080 --name geoserver-vuln geoserver:2.25.0
   

2. Access the welcome page at http://localhost:8080/geoserver/web/ or the about page at http://localhost:8080/geoserver/web/about.

Exploitation:

1. Send a GET request to the welcome page:

   curl http://localhost:8080/geoserver/web/
   

2. Parse the response for version information:

   curl http://localhost:8080/geoserver/web/ | grep -oP 'GeoServer \d+\.\d+\.\d+'
   

3. Alternatively, access the about page:

   curl http://localhost:8080/geoserver/web/about
   

Blue Team

Detection:

• Monitor HTTP requests to /geoserver/web/ and /geoserver/web/about from external IPs.
• Look for patterns in User-Agent strings or request frequency that indicate automated scanning.

Mitigation:

• Upgrade to GeoServer 2.26.0 or later.
• If upgrade is not possible, restrict access to the welcome and about pages using a reverse proxy or firewall rules.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP requests to /geoserver/web/ or /geoserver/web/about from unknown external IPs.
  • Responses containing version strings like GeoServer 2.25.0 or similar.

• File IOCs:

  • Log entries in GeoServer access logs showing requests to the welcome or about pages.

Detection Engineering

YARA Rule

rule CVE_2024_35230_GeoServer_InfoDisclosure {
    meta:
        description = "Detects GeoServer version information disclosure in HTTP responses"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "CVE-2024-35230"
    strings:
        $version = /GeoServer \d+\.\d+\.\d+/
        $revision = /Revision: [a-f0-9]+/
    condition:
        any of them
}

Sigma Rule

title: GeoServer Version Information Disclosure
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to retrieve version information from GeoServer welcome or about pages
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-uri-stem:
            - '/geoserver/web/'
            - '/geoserver/web/about'
    condition: selection
falsepositives:
    - Legitimate administrative access
level: medium

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-35230 GeoServer Version Information Disclosure"; flow:to_server; content:"GET"; http_method; content:"/geoserver/web/"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GeoServer to version 2.26.0 or later.
2. If upgrade is not possible, restrict access to the welcome and about pages using a reverse proxy or firewall rules.

Long-term Measures:

• Implement a Web Application Firewall (WAF) to block requests to sensitive endpoints.
• Regularly update GeoServer and its dependencies.
• Conduct security audits to identify similar information disclosure vulnerabilities.

Workarounds:

• No known workarounds exist. The only solution is to upgrade.

Valters IT