GHSA-2p76-gc46-5fvc: GeoNetwork affected by XML External Entity (XXE) processing vulnerability in WFS indexing REST API endpoint
8.2
Basic Information
JavaTechnical Details
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.geonetwork-opensource:gn-web-app | maven | >= 4.4.0, <= 4.4.7 | 4.4.8 |
| org.geonetwork-opensource:gn-web-app | maven | >= 4.2.0, <= 4.2.12 | 4.2.13 |
| org.geonetwork-opensource:gn-wfsfeature-harvester | maven | >= 4.4.0, <= 4.4.7 | 4.4.8 |
| org.geonetwork-opensource:gn-wfsfeature-harvester | maven | >= 4.2.0, <= 4.2.12 | 4.2.13 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability is an XML External Entity (XXE) injection flaw that occurs in the GeoTools library during schema validation when GeoNetwork's WFS Index functionality is used. The GeoNetwork application exposes this vulnerability through its WFS indexing REST API endpoints, which were initially not secured, allowing unauthenticated access.
The primary patch (commit d71e8348342ee3c6d38e5698e7abcf326fc9863d from PR #8757) addresses the lack of authentication on these endpoints. Specifically, it adds @PreAuthorize("hasAuthority('Editor')") annotations to the indexWfs and deleteWfs methods within the org.fao.geonet.harvester.wfsfeatures.WFSHarvesterApi class.
-
org.fao.geonet.harvester.wfsfeatures.WFSHarvesterApi.indexWfs: This method is the most likely direct entry point for the XXE attack. It takes aWFSHarvesterParameteras a request body, which would contain the XML data. The XXE vulnerability in GeoTools is triggered during schema validation of this XML. The patch adding authentication confirms this method was an unsecured entry point. -
org.fao.geonet.harvester.wfsfeatures.WFSHarvesterApi.deleteWfs: This method was also patched to require authentication. While it might not be the primary vector for the XXE (as XXE usually occurs during parsing of complex XML input, more typical of an 'index' or 'create' operation), its inclusion in the security patch indicates it was an unsecured part of the vulnerable WFS Index functionality.
The other two pull requests (PR #8803 and PR #8812) and their associated commits (2906f9e1d5e84a3b254f725780c7966ae8dce3b4 and 2be40410defa92098a1f157be257aaefc9e351d9) involve updating the GeoTools library version in the pom.xml. This is the fix for the underlying XXE vulnerability within GeoTools itself.
Therefore, the GeoNetwork functions indexWfs and deleteWfs are identified as vulnerable because they were the unauthenticated gateways that allowed attackers to trigger the XXE flaw in the GeoTools dependency. The indexWfs function is the most direct route for exploitation as it handles the XML input that is subject to schema validation.