CVE-2023-41877: GeoServer path traversal in log file configuration

Executive brief

GeoServer, an open-source server for sharing geospatial data, contains a vulnerability that allows an administrator to change the log file location to any directory on the server. By manipulating this setting, an attacker with administrative access can read sensitive system files or potentially take full control of the server by overwriting critical files. This could lead to data theft, service disruption, or a complete system compromise.

Technical details

A path traversal vulnerability (CWE-22) exists in GeoServer's Global Settings where the log file location is defined. An authenticated attacker with GeoServer Administrator privileges can modify the 'log file location' parameter to point to arbitrary paths on the file system. This allows for arbitrary file read via the GeoServer Logs page in the admin console. Furthermore, by overwriting critical system or application files, an attacker can achieve Remote Code Execution (RCE) or cause a Denial of Service (DoS). The issue is addressed in GeoServer 3.0.0 by removing the ability to set the log location via the UI, restricting it to system-level parameters.

Affected products

• GeoServer GeoServer <= 2.23.4

Timeline

• 2024-03-19: disclosed
• 2024-03-20: advisory: GitHub Advisory published

References

• https://api.github.com/users/Anthares101
• https://github.com/Anthares101
• https://api.github.com/users/Anthares101/gists%7B/gist_id%7D
• https://api.github.com/users/Anthares101/repos
• https://avatars.githubusercontent.com/u/33127189?v=4
• https://api.github.com/users/Anthares101/events%7B/privacy%7D