QID 150751

Date Published: 2023-11-30

QID 150751: GeoServer Web Map Service (WMS) Dynamic Styling Server-Side Request Forgery (SSRF) Vulnerability (CVE-2023-41339)

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data.

In GeoServer, WMS specification defines an "sld" parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, potentially leads to Service-Side Request Forgery (SSRF) attacks.

Affected Versions:
GeoServer Versions prior to version 2.22.5
GeoServer Versions prior to version 2.23.2

QID Detection Logic (Unauthenticated):
This QID sends HTTP GET request to "/geoserver/ows" endpoint with vulnerable parameter containing Out-of-band (OOB) payload where vulnerable servers will make a DNS query that will trigger Qualys Periscope detection mechanism.

Successful exploitation of this vulnerability could allow an unauthenticated attacker to execute Blind SSRF attack to steal NetNTLMv2 hashes via file requests to malicious servers.

CVSS V3 rated as Medium - 5.3 severity.

CVSS V2 rated as Critical - 9 severity.

Solution

Customers are advised to upgrade to relevant GeoServer version 2.22.5, 2.23.2 or later to remediate this vulnerability. For more information pertaining to this vulnerability please refer GeoServer Security Advisory.

Vendor References

GeoServer Security Advisory - github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmf

CVEs related to QID 150751

CVE-2023-41339 |

Software Advisories

Advisory ID	Software	Component	Link
GeoServer Security Advisory			github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmf

By selecting these links, you may be leaving CVEreport webspace. We have provided these links to other websites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other websites that are more appropriate for your purpose. CVEreport does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, CVEreport does not endorse any commercial products that may be mentioned on these sites. Please address comments about any linked pages to [email protected].