CVE-2023-35042: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

June 12, 2023 (updated September 19, 2023)

** DISPUTED ** GeoServer 2, in some configurations, allows remote attackers to execute arbitrary code via java.lang.Runtime.getRuntime().exec in wps:LiteralData within a wps:Execute request, as exploited in the wild in June 2023. NOTE: the vendor states that they are unable to reproduce this in any version.

References

docs.geoserver.org/stable/en/user/services/wps/operations.html
geoserver.org/vulnerability/2022/04/11/geoserver-2-jiffle-jndi-rce.html
github.com/advisories/GHSA-59x6-g4jr-4hxc
isc.sans.edu/diary/29936
nvd.nist.gov/vuln/detail/CVE-2023-35042
osgeo-org.atlassian.net/browse/GEOS-10458

Detect and mitigate CVE-2023-35042 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →