CVE-2022-24847: GeoServer JNDI Injection RCE Vulnerability

CVE-2022-24847 Overview

CVE-2022-24847 is an insecure deserialization vulnerability in GeoServer, an open source software server written in Java that enables users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI (Java Naming and Directory Interface) lookup, which can be exploited to perform class deserialization and result in arbitrary code execution. This vulnerability can also be triggered while configuring data stores with data sources located in JNDI, or while setting up the disk quota mechanism.

Critical Impact

Authenticated attackers with administrative privileges can achieve arbitrary code execution on the GeoServer instance through JNDI injection, potentially leading to complete system compromise.

Affected Products

• OSGeo GeoServer versions prior to 2.21.0
• OSGeo GeoServer versions prior to 2.20.4
• OSGeo GeoServer versions prior to 1.19.6

Discovery Timeline

• 2022-04-13 - CVE-2022-24847 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-24847

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) and improper neutralization of special elements used in an expression language statement (CWE-917). The GeoServer application fails to properly restrict JNDI lookups within its security mechanism, creating a pathway for expression language injection attacks.

When processing certain administrative operations, GeoServer performs JNDI lookups without adequate validation of the lookup target. An attacker who has obtained administrative access to the GeoServer instance can craft malicious JNDI references that, when resolved, trigger arbitrary class deserialization. This deserialization process can be manipulated to instantiate attacker-controlled classes and execute arbitrary code on the server.

The vulnerability is exploitable through two primary interfaces: the GeoServer graphical user interface (geoserver/web) and the REST API (geoserver/rest). Both pathways accept administrative configuration changes that can include malicious JNDI references.

Root Cause

The root cause of this vulnerability is insufficient validation of JNDI lookup targets within GeoServer's security mechanism and data store configuration components. The application accepts arbitrary JNDI references without restricting the protocols or destinations that can be used, enabling attackers to leverage remote class loading capabilities inherent in JNDI to achieve code execution.

Attack Vector

The attack requires network access to the GeoServer instance and valid administrative credentials. Once authenticated as an administrator, the attacker can exploit this vulnerability by:

1. Accessing the GeoServer GUI or REST API with admin credentials
2. Navigating to data store configuration or disk quota settings
3. Injecting a malicious JNDI reference pointing to an attacker-controlled server
4. The vulnerable GeoServer instance resolves the JNDI reference, fetching and deserializing a malicious Java class
5. Arbitrary code execution occurs in the context of the GeoServer process

The attack leverages JNDI injection patterns similar to those seen in Log4Shell (CVE-2021-44228), where JNDI lookups to attacker-controlled LDAP or RMI servers can trigger malicious class loading. Further technical details are available in the GeoServer Security Advisory.

Detection Methods for CVE-2022-24847

Indicators of Compromise

• Unusual outbound LDAP, RMI, or DNS connections from the GeoServer server to unknown external hosts
• Suspicious administrative activity in GeoServer access logs, particularly around data store or disk quota configuration endpoints
• Unexpected Java processes or child processes spawned by the GeoServer application
• Modified data store configurations containing JNDI URI references (e.g., ldap://, rmi://, dns://)

Detection Strategies

• Monitor network traffic from GeoServer servers for outbound LDAP (port 389/636) or RMI (port 1099) connections to external addresses
• Implement web application firewall rules to detect JNDI injection patterns in HTTP requests to /geoserver/web and /geoserver/rest endpoints
• Enable and review GeoServer audit logging for administrative configuration changes
• Deploy endpoint detection and response (EDR) solutions to identify anomalous process creation from Java applications

Monitoring Recommendations

• Establish baseline network behavior for GeoServer instances and alert on deviations, particularly outbound connections to non-standard ports
• Configure SIEM rules to correlate administrative authentication events with subsequent configuration changes
• Monitor file system integrity on GeoServer servers for unexpected file creation or modification
• Review GeoServer configuration files periodically for unauthorized JNDI data source references

How to Mitigate CVE-2022-24847

Immediate Actions Required

• Upgrade GeoServer to version 2.21.0, 2.20.4, or 1.19.6 or later immediately
• Audit administrative accounts and remove unnecessary admin access
• Review existing data store and disk quota configurations for suspicious JNDI references
• Implement network segmentation to limit GeoServer's ability to make outbound connections

Patch Information

The GeoServer development team has addressed this vulnerability by restricting JNDI lookups in the following versions:

• GeoServer 2.21.0
• GeoServer 2.20.4
• GeoServer 1.19.6

Organizations should upgrade to these versions or later to receive the fix. The security advisory and patch details are available at the GeoServer GitHub Security Advisory.

Workarounds

• Restrict access to geoserver/web and geoserver/rest endpoints via firewall rules to trusted administrative networks only
• Ensure that GeoWebCache is not remotely accessible from untrusted networks
• Implement a reverse proxy with authentication in front of GeoServer administrative interfaces
• Use network-level controls to block outbound LDAP, RMI, and suspicious DNS traffic from GeoServer servers

# Example iptables rules to restrict GeoServer admin access
# Allow admin access only from trusted network (e.g., 10.0.1.0/24)
iptables -A INPUT -p tcp --dport 8080 -s 10.0.1.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

# Block outbound LDAP/RMI connections from GeoServer
iptables -A OUTPUT -p tcp --dport 389 -j DROP
iptables -A OUTPUT -p tcp --dport 636 -j DROP
iptables -A OUTPUT -p tcp --dport 1099 -j DROP