GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The WMS specification defines an ``sld=<url>`` parameter for GetMap, GetLegendGraphic and GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without also configuring URL checks, provides the opportunity for Service Side Request Forgery. This vulnerability can be used to steal user NetNTLMv2 hashes which could be relayed or cracked externally to gain further access. This vulnerability has been patched in versions 2.22.5 and 2.23.2.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GeoServer is an open source software server written in Java that allows users to share and edit geospatial
    data. The WMS specification defines an ``sld=<url>`` parameter for GetMap, GetLegendGraphic and
    GetFeatureInfo operations for user supplied "dynamic styling". Enabling the use of dynamic styles, without
    also configuring URL checks, provides the opportunity for Service Side Request Forgery. This vulnerability
    can be used to steal user NetNTLMv2 hashes which could be relayed or cracked externally to gain further
    access. This vulnerability has been patched in versions 2.22.5 and 2.23.2. (CVE-2023-41339)

According to its banner, the version of GeoServer running on the remote host is prior to 2.22.5 or 2.23.0 < 2.23.2. It is, therefore, affected by Multiples Vulnerabilities :

- A Server Side Request Forgery in Web Processing Service (WPS) - A Server Side Request Forgery in the dynamic styling sld=<url> parameter

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
414041	SCA: security update for org.geoserver.web:gs-web-app, org.geoserver:gs-wms (GHSA-cqpc-x2c6-2gmf)	Tenable Cloud Security	SCA Checks	medium
414041	SCA: security update for org.geoserver.web:gs-web-app, org.geoserver:gs-wms (GHSA-cqpc-x2c6-2gmf)	Tenable Self-Hosted Container Security	SCA Checks	medium
114539	GeoServer 2.23.0 < 2.23.1 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	critical
114538	GeoServer < 2.22.5 Multiples Vulnerabilities	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2023-41339

medium

Tenable Plugins

medium

medium

critical

critical