Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.2
CVE-2022-24847: GeoServer admin access can execute any code
CVE-2022-24847 · published 4 years ago
Summary
If an attacker gains administrator rights in GeoServer, they can use the web interface or API to trigger unsafe lookups that run their own code on the server. This risk affects GeoServer versions before the fixes in 2.21.0, 2.20.4, and 1.19.6. Upgrade to a patched version, or block external access to the GeoServer web and REST endpoints and keep the cache component private.
What to do
- Update geoserver org.geoserver:gs-main to version 2.20.4.
- Update geoserver org.geoserver:gs-main to version 2.19.6.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| maven | geoserver | org.geoserver:gs-main |
>= 2.20.0, < 2.20.4 < 2.19.6 Fix: upgrade to 2.20.4
|
| – | osgeo | geoserver |
< 2.19.6 >= 2.20.0, < 2.20.4 cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:* |
Original advisory text
Improper Input Validation in GeoServer
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arbitrary code execution. The same can happen while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism. In order to perform any of the above changes, the attack needs to have obtained admin rights and use either the GeoServer GUI, or its REST API. The lookups are going to be restricted in GeoServer 2.21.0, 2.20.4, 1.19.6. Users unable to upgrade should restrict access to the `geoserver/web` and `geoserver/rest` via a firewall and ensure that the GeoWebCache is not remotely accessible.
References
- https://github.com/geoserver/geoserver/commit/b94a69943992df999d627b21a4ed056fad...
- https://github.com/advisories/GHSA-4pm3-f52j-8ggh
- https://github.com/geoserver/geoserver/security/advisories/GHSA-4pm3-f52j-8ggh Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2022-24847 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24847... Vendor Advisory
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-20Improper Input Validation
CWE-917Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
Timeline
Published13 Apr 2022
Updated3 Nov 2026
First seen6 Mar 2026
Track software like this
Free during beta