github.com
https://github.com/geosolutions-it/jai-ext CVE-2022-24816
CRITICALCISA KEVNuclei
Improper Control of Generation of Code in jai-ext
Record summary
CVE-2022-24816 has a selected CVSS score of 10.0 (critical); EIP currently links 1 repository PoC and 1 Nuclei template. CISA lists CVE-2022-24816 in KEV.
Description
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
Description source: CVE List
Exploitation context
Known exploitation
- CISA KEV
- Listed · Jun 26, 2024 · CISA
- VulnCheck KEV
- Listed · Jan 22, 2024 · VulnCheck
- Reported exploitation
- Observed · VulnCheck
Available material
CISA SSVC decision
ExploitationActive
AutomatableYes
Technical impactTotal
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 26, 2024 · Source: CVE List
Affected products and versions
5| Product | Source | Version range | Status |
|---|---|---|---|
JAI-EXTBrowse OSGeo / JAI-EXT | CISA | Version data not supplied | |
| CVE List | < 1.1.22 | affected | |
Default status: unknown | CVE List | Before 1.1.22 | affected |
it.geosolutions.jaiext.jiffle:jt-jiffleBrowse Maven / it.geosolutions.jaiext.jiffle:jt-jiffle | GitHub Advisory | Before 1.1.22 · Fixed in 1.1.22 | affected |
it.geosolutions.jaiext.jiffle:jt-jiffle-languageBrowse Maven / it.geosolutions.jaiext.jiffle:jt-jiffle-language | GitHub Advisory | Before 1.1.22 · Fixed in 1.1.22 | affected |
Proofs of concept
1Repository PoCs
GitHubc1ph3rbyt3/CVE-2022-24816Repository PoCby c1ph3rbyt3Stars: 1Not analyzed4 files
Nuclei templates
1ProjectDiscoveryCRITICALGeoServer <1.2.2 - Remote Code ExecutionCVSS 9.8
Programs run on GeoServer before 1.2.2 which use jt-jiffle and allow Jiffle script to be provided via network request are susceptible to remote code execution. The Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects downstream GeoServer 1.1.22.
Impact
Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the target system.
Remediation
1.2.22 contains a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application by removing janino-x.y.z.jar from the classpath.
WeaknessesCWE-94
Authorsmukundbhuva
Template tagscvecve2022geoserverrcegeosolutionsgroupkevvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CPE: cpe:2.3:a:geosolutionsgroup:jai-ext:*:*:*:*:*:*:*:*
Shodan: /geoserver/
FOFA: app="GeoServer"
FOFA: app="geoserver"
https://www.synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver.html https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb https://nvd.nist.gov/vuln/detail/CVE-2022-24816 https://github.com/tanjiti/sec_profile
Source: ProjectDiscovery
References
5github.com
https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb github.comConfirmation
https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2022-24816 cisa.govGovernment resource
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24816