5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2024-40625

CVE-2024-40625: Coverage REST API Server Side Request Forgery

Summary

The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allow to upload file with a specified url (with {method} equals 'url') with no restrict.

Details

The Coverage rest api /workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format} allow to upload file with a specified url (with {method} equals 'url'). But this url has not been check with URL Checks feature.

For example, should add the code below to check fileURL:

URLCheckers.confirm(fileURL)

The vulnerable code was RESTUtils.java

Impact

This vulnerability presents the opportunity for Server Side Request Forgery.

References

https://osgeo-org.atlassian.net/browse/GEOS-11468
https://osgeo-org.atlassian.net/browse/GEOS-11717

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2024-40625

CVE-2024-40625:

5.5

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.geoserver:gs-rest	maven	< 2.26.0	2.26.0
org.geoserver.web:gs-web-app	maven	< 2.26.0	2.26.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies in the Coverage REST API, specifically when uploading a file using the 'url' method. The provided description clearly identifies RESTUtils.java and a specific line (176 in the linked version) as containing the vulnerable code. This line is within the getRemoteSource method. The vulnerability occurs because this method takes a user-supplied URL (sourceURLValue) and uses it to fetch data without adequate validation, as recommended by GeoServer's URL Checks feature (URLCheckers.confirm(fileURL)). An attacker can craft a malicious URL to make the server perform unintended requests to internal or external services, which is characteristic of an SSRF vulnerability. The getRemoteSource function in org.geoserver.rest.util.RESTUtils is directly responsible for handling this URL and is therefore the vulnerable function. The patch would involve adding the URLCheckers.confirm() call within this function to validate the URL before it's used.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.