CVE-2023-41877: GeoServer path traversal in log file configuration

CVE-2023-41877 · Severity: high · CVSS 7.2 · Published 2024-03-20

GeoServer, an open-source server for sharing geospatial data, contains a vulnerability that allows an administrator to change the log file location to any directory on the server. By manipulating this setting, an attacker with administrative access can read sensitive system files or potentially take full control of the server by overwriting critical files. This could lead to data theft, service disruption, or a complete system compromise.

Technologies: org.geoserver:gs-main (Maven). Vendors: Maven.

Quick answers

Is CVE-2023-41877 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2023-41877 being exploited in the wild.
How severe is CVE-2023-41877?
High severity, with a CVSS score of 7.2, published 20 March 2024.
Which products and versions are affected?
org.geoserver:gs-main (Maven) <= 2.23.4, ECOSYSTEM:introduced=0,last_affected=2.23.4.
Is there a fix for CVE-2023-41877?
No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2023-41877 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2023-41877?
Check whether you run org.geoserver:gs-main (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A path traversal vulnerability (CWE-22) exists in GeoServer's Global Settings where the log file location is defined. An authenticated attacker with GeoServer Administrator privileges can modify the 'log file location' parameter to point to arbitrary paths on the file system. This allows for arbitrary file read via the GeoServer Logs page in the admin console. Furthermore, by overwriting critical system or application files, an attacker can achieve Remote Code Execution (RCE) or cause a Denial of Service (DoS). The issue is addressed in GeoServer 3.0.0 by removing the ability to set the log location via the UI, restricting it to system-level parameters.

Affected products

  • GeoServer GeoServer <= 2.23.4

Identifiers

  • CVE-2023-41877
  • GHSA-8g7v-vjrc-x4g5

Timeline

  • 2024-03-19: disclosed
  • 2024-03-20: advisory: GitHub Advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.