Miggo Logo
Miggo Vulnerability Database
→
CVE-2022-24847

CVE-2022-24847: Improper Input Validation in GeoServer

7.2

CVSS Score
3.1

Basic Information

CVE ID
CVE-2022-24847
GHSA ID
GHSA-4pm3-f52j-8ggh
EPSS Score
0.35924%
CWE
CWE-20
Published
4/22/2022
Updated
6/27/2023
KEV Status
No
Technology
TechnologyJava

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
org.geoserver:gs-mainmaven>= 2.20.0, < 2.20.42.20.4
org.geoserver:gs-mainmaven< 2.19.62.19.6

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from unvalidated JNDI lookups across multiple components. The commit diff shows removal of direct JNDI context creation (Context/InitialContext) and replacement with GeoTools.jndiLookup(), which likely adds validation. The original patterns in these functions allowed: 1) Unrestricted JNDI resolution 2) No validation of looked-up object types 3) Direct use of attacker-controlled strings for JNDI names. These functions handled security-sensitive operations (datasource configuration, connection testing) with admin privileges but without proper input sanitization, enabling expression language injection and deserialization attacks via malicious JNDI references.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t T** **oS*rv*r s**urity m****nism **n p*r*orm *n un****k** JN*I lookup, w*i** in turn **n ** us** to p*r*orm *l*ss **s*ri*liz*tion *n* r*sult in *r*itr*ry *o** *x**ution. T** s*m* **n **pp*n w*il* *on*i*urin* **t* stor*s wit* **t* sour**s l

Reasoning

T** vuln*r**ility st*ms *rom unv*li**t** JN*I lookups **ross multipl* *ompon*nts. T** *ommit *i** s*ows r*mov*l o* *ir**t JN*I *ont*xt *r**tion (*ont*xt/Initi*l*ont*xt) *n* r*pl***m*nt wit* `**oTools.jn*iLookup()`, w*i** lik*ly ***s v*li**tion. T** o