Executive brief
GeoLens is a geospatial data platform that manages access to maps, datasets, and tile imagery. Multiple authorization and caching flaws allow authenticated and anonymous users to access private dataset metadata, personally identifiable information (contact details), tile data, and enumeration of non-public datasets without authorization. Additionally, credentials may be leaked via logs and process environment variables, and weak default installer credentials could enable account takeover.
Technical details
The vulnerability encompasses multiple authorization and information-disclosure flaws in GeoLens before version 1.2.4. Record metadata endpoints (contact, keyword, distribution) fail to re-authorize the backing dataset, allowing any authenticated user to access private PII. Private raster and vector tiles are served with `Cache-Control: public` headers, enabling shared caches (CDNs, reverse proxies) to retain and replay private tile bytes to unauthenticated users. The map visibility-check endpoint lacks authorization for map read access, permitting dataset-title enumeration by any editor. URL validation for user-supplied service URLs resolves DNS once then allows client re-resolution, enabling DNS-rebinding SSRF attacks to internal/metadata addresses. The remote-service preview path passes authorization tokens to GDAL via unsanitized environment variables, leaking credentials via `/proc/<pid>/environ` and allowing CRLF header injection. The POST /search endpoint lacks size limits on GeoJSON geometries (unlike GET), enabling DoS. Additional issues include cleartext API-key logging, security settings coupled to a logging flag rather than explicit configuration, missing Content-Security-Policy headers, and weak default database/admin credentials retained by the installer. Patch: upgrade to GeoLens 1.2.4; no configuration changes required for auth/cache fixes, though setting `ENVIRONMENT=production` is recommended.
Affected products
- GeoLens GeoLens < 1.2.4
Timeline
- 2026-06-11: disclosed
- 2026-06-11: patched: version 1.2.4 released
- 2026-08-19: advisory