CVE-2022-24816: Geosolutionsgroup JAI-EXT RCE Vulnerability

CVE-2022-24816 Overview

CVE-2022-24816 is a critical Remote Code Execution (RCE) vulnerability affecting JAI-EXT, an open-source project designed to extend the Java Advanced Imaging (JAI) API. The vulnerability exists in the handling of Jiffle scripts, which are compiled into Java code via the Janino compiler and subsequently executed. Attackers can exploit this flaw by providing malicious Jiffle scripts via network requests, enabling arbitrary code execution on vulnerable systems. Notably, this vulnerability impacts the downstream GeoServer project, significantly expanding the attack surface.

Critical Impact

This vulnerability allows unauthenticated remote attackers to execute arbitrary code on affected systems by injecting malicious code through Jiffle scripts. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild.

Affected Products

• geosolutionsgroup jai-ext (versions prior to 1.2.22)
• GeoServer (downstream project utilizing JAI-EXT)
• Applications accepting Jiffle scripts via network requests

Discovery Timeline

• 2022-04-13 - CVE-2022-24816 published to NVD
• 2025-10-24 - Last updated in NVD database

Technical Details for CVE-2022-24816

Vulnerability Analysis

This Code Injection vulnerability (CWE-94) stems from insufficient input validation in the Jiffle scripting engine. When applications allow Jiffle scripts to be submitted via network requests, the scripts are compiled into Java bytecode using the Janino compiler and executed directly on the server. The lack of proper sanitization allows attackers to inject malicious Java code into the compilation process, resulting in arbitrary code execution with the privileges of the running application.

The vulnerability is particularly dangerous because it requires no authentication and can be exploited remotely over the network. The scope is changed, meaning a successful exploit can affect resources beyond the vulnerable component's security scope, potentially compromising the entire system or other connected resources.

Root Cause

The root cause of this vulnerability is inadequate validation of Jiffle script input variable names and improper handling of user-supplied content during the script-to-Java compilation process. The original implementation lacked proper grammar validation for identifiers and failed to properly escape potentially dangerous content like javadoc comments, allowing attackers to break out of the intended script context and inject arbitrary Java code.

Attack Vector

The attack vector is network-based, requiring no privileges or user interaction. An attacker can craft a malicious Jiffle script containing injected Java code and submit it to an application that processes Jiffle scripts via HTTP requests. When the application compiles and executes the script, the malicious payload is executed on the server.

The attack flow typically involves:

1. Identifying an exposed endpoint that accepts Jiffle scripts (commonly in GeoServer deployments)
2. Crafting a malicious Jiffle script with embedded Java code injection
3. Submitting the payload via network request
4. Achieving code execution when the script is compiled and run

// Security patch excerpt from Jiffle.java
// Source: https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb
     
     public static final Logger LOGGER = Logger.getLogger(Jiffle.class.getName());
     
-    private static Pattern BLOCK_COMMENT_STRIPPER = Pattern.compile("(?:/\\*(?:[^*]|(?:\\*+[^*/]))*\\*+/)");
+    boolean includeScript;

     /** 
      * Constants for runtime model. Jiffle supports two runtime models:

// Security patch excerpt from Script.java - Adding identifier validation
// Source: https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb
 import it.geosolutions.jaiext.jiffle.parser.UndefinedOptionException;

 import java.util.Collections;
-import java.util.List;
 import java.util.Map;
 import java.util.Objects;
 import java.util.Set;
+import java.util.regex.Pattern;

 /** @author michael */
 public class Script implements Node {
+
+    /** <pre>ID      : (Letter) (Letter | UNDERSCORE | Digit | Dot)*</pre> */
+    private static final Pattern VALID_IDENTIFIER = Pattern.compile("^[a-zA-Z][_a-zA-Z0-9\\.]*$");
+
     private final StatementList stmts;
     private final RepeatedReadOptimizer readOptimizer;
     private Map<String, String> options;

Detection Methods for CVE-2022-24816

Indicators of Compromise

• Unusual Java process activity spawning child processes or making unexpected network connections
• Presence of suspicious Jiffle scripts in application logs containing encoded or obfuscated content
• Web server logs showing requests to endpoints accepting Jiffle scripts with abnormally large or complex payloads
• Unexpected file creation or modification in GeoServer deployment directories

Detection Strategies

• Monitor network traffic for HTTP requests containing Jiffle script submissions to GeoServer or JAI-EXT endpoints
• Implement web application firewall (WAF) rules to inspect and block suspicious script content in request bodies
• Deploy endpoint detection and response (EDR) solutions to identify anomalous Java process behavior indicative of code injection
• Review application logs for Jiffle compilation errors that may indicate attempted exploitation

Monitoring Recommendations

• Enable verbose logging for applications utilizing JAI-EXT Jiffle script processing
• Configure alerting for any Java process spawning unexpected child processes or establishing outbound connections
• Monitor for modifications to JAI-EXT configuration files or classpath entries
• Track authentication and access patterns to GeoServer administrative interfaces

How to Mitigate CVE-2022-24816

Immediate Actions Required

• Upgrade JAI-EXT to version 1.2.22 or later immediately, as this version contains the security patch
• If using GeoServer, apply the corresponding security updates that address this vulnerability
• Restrict network access to endpoints that accept Jiffle scripts to trusted sources only
• Review and audit any applications that may be accepting Jiffle scripts from untrusted sources

Patch Information

The security patch has been released in JAI-EXT version 1.2.22. The fix implements proper validation of Jiffle input variable names according to the grammar specification using a strict regex pattern (^[a-zA-Z][_a-zA-Z0-9\\.]*$) and properly escapes javadoc content to prevent code injection. Organizations should upgrade to this version or later to address the vulnerability.

For detailed patch information, refer to the GitHub Security Advisory and the GitHub Commit.

Workarounds

• Remove janino-x.y.z.jar from the application classpath to disable Jiffle script compilation entirely
• Implement network-level controls to block external access to endpoints that process Jiffle scripts
• Deploy a reverse proxy or WAF with rules to filter potentially malicious Jiffle script content
• Disable or remove any unnecessary Jiffle script processing functionality from production deployments

# Configuration example - Remove Janino from classpath to disable Jiffle compilation
# Navigate to your application's lib directory
cd /path/to/application/lib/

# Backup and remove Janino JAR files
mkdir -p /path/to/backup/
mv janino-*.jar /path/to/backup/

# Restart the application to apply changes
systemctl restart geoserver
# or
./shutdown.sh && ./startup.sh