CVE-2024-45747: GeoServer has a Server-Side Template Injection (SSTI) vulnerability in processing FreeMarker templates
A server-side template injection (SSTI) vulnerability exist that allows an authenticated administrator to upload FreeMarker templates containing malicious content that can execute OS commands and read from or write to arbitrary files on the server. These FreeMarker templates are used in a plain GeoServer instance (no extension or community modules) for WMS GetFeatureInfo HTML and JSON and WMS GetMap KML and GeoRSS output formats.
References
- docs.geoserver.org/latest/en/user/tutorials/GetFeatureInfo/html/
- github.com/advisories/GHSA-wf6j-gr27-g7ch
- github.com/geoserver/geoserver/pull/8164
- github.com/geoserver/geoserver/security/advisories/GHSA-wf6j-gr27-g7ch
- nvd.nist.gov/vuln/detail/CVE-2024-45747
- osgeo-org.atlassian.net/browse/GEOS-11645
- osgeo-org.atlassian.net/browse/GEOS-11777
Code Behaviors & Features
Detect and mitigate CVE-2024-45747 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →