CVE-2023-35042: Geoserver RCE Vulnerability

CVE-2023-35042 Overview

CVE-2023-35042 is a critical remote code execution (RCE) vulnerability affecting GeoServer 2 in certain configurations. The vulnerability allows remote attackers to execute arbitrary code by exploiting the Web Processing Service (WPS) Execute functionality. Attackers can achieve code execution through malicious java.lang.Runtime.getRuntime().exec calls embedded within wps:LiteralData elements of a wps:Execute request. This vulnerability was reportedly exploited in the wild in June 2023, highlighting the active threat it poses to unpatched GeoServer deployments.

Critical Impact
This vulnerability enables unauthenticated remote code execution on vulnerable GeoServer instances, potentially allowing attackers to gain complete control over the underlying server and access sensitive geospatial data.

Affected Products

GeoServer 2 (in certain configurations)
GeoServer deployments with WPS service enabled
GeoServer instances exposing WPS Execute endpoints

Discovery Timeline

June 2023 - Vulnerability exploited in the wild
2023-06-12 - CVE-2023-35042 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-35042

Vulnerability Analysis

This remote code execution vulnerability exists in the GeoServer Web Processing Service (WPS) component. The WPS service provides standardized interfaces for geospatial processing operations, and the Execute operation allows clients to run specific processes on the server. In vulnerable configurations, the service fails to properly sanitize or restrict the execution of Java runtime commands within WPS request payloads.

The attack exploits the processing of wps:LiteralData elements within wps:Execute requests. When the WPS service processes these requests, it can be manipulated to invoke java.lang.Runtime.getRuntime().exec(), allowing attackers to execute arbitrary system commands on the server. This type of code injection attack bypasses normal security controls because the malicious payload is delivered through what appears to be a legitimate WPS processing request.

It is worth noting that the vendor has stated they are unable to reproduce this vulnerability in any version, which may indicate the exploitation requires specific non-default configurations or third-party extensions to be present.

Root Cause

The root cause stems from insufficient input validation and sanitization in the WPS Execute request handler. When processing wps:LiteralData content, the application fails to properly restrict or sanitize Java method invocations, allowing attackers to inject malicious code that gets executed in the context of the GeoServer application. The vulnerability likely requires specific process configurations or extensions that enable the evaluation of Java expressions within literal data fields.

Attack Vector

The attack is network-based and requires no authentication or user interaction. An attacker can craft a malicious HTTP POST request to the GeoServer WPS endpoint containing a specially crafted wps:Execute XML payload. The payload includes a wps:LiteralData element with embedded Java runtime execution commands. When the server processes this request, it executes the attacker's commands with the privileges of the GeoServer application process.

The exploitation typically targets the /geoserver/wps or /geoserver/ows?service=WPS endpoints. The malicious payload leverages Java's Runtime.getRuntime().exec() method to spawn system processes, enabling activities such as reverse shell establishment, data exfiltration, or deployment of additional malware.

For technical details on the WPS Execute operation, refer to the GeoServer WPS Operations Documentation. Additional analysis of exploitation activity is available in the SANS ISC Security Diary Entry.

Detection Methods for CVE-2023-35042

Indicators of Compromise

HTTP POST requests to /geoserver/wps or /geoserver/ows?service=WPS endpoints containing suspicious XML payloads
Presence of java.lang.Runtime or getRuntime().exec strings in WPS request logs
Unusual child processes spawned by the Java/Tomcat process running GeoServer
Unexpected outbound network connections from the GeoServer host

Detection Strategies

Monitor web server access logs for POST requests to WPS endpoints with abnormally large payloads or suspicious content patterns
Implement Web Application Firewall (WAF) rules to detect and block requests containing Runtime.getRuntime().exec patterns
Deploy endpoint detection solutions to monitor for suspicious process creation events originating from Java application processes
Analyze network traffic for signs of command-and-control communication or data exfiltration from GeoServer hosts

Monitoring Recommendations

Enable detailed logging for all WPS service requests and review logs regularly for anomalous activity
Configure alerts for any process execution originating from the GeoServer application context that doesn't match expected behavior
Monitor system resource usage on GeoServer hosts for signs of cryptomining or other unauthorized activities
Implement network segmentation and monitor for lateral movement attempts from compromised GeoServer instances

How to Mitigate CVE-2023-35042

Immediate Actions Required

Disable the WPS service if not required for business operations by removing or disabling the WPS extension
Implement network-level access controls to restrict access to WPS endpoints to trusted IP addresses only
Deploy WAF rules to filter malicious WPS Execute requests containing Java runtime execution patterns
Review GeoServer logs for signs of past exploitation attempts

Patch Information

The vendor has stated they are unable to reproduce this vulnerability in any version. Organizations should monitor GeoServer security advisories for updates. In the absence of a specific patch, implementing the defensive measures outlined in this article is critical. Review the GeoServer WPS Operations Documentation for configuration guidance and security best practices.

Workarounds

Disable WPS service entirely if geospatial processing capabilities are not required
Configure GeoServer security settings to require authentication for WPS service access
Implement network segmentation to isolate GeoServer instances from critical infrastructure
Use a reverse proxy or WAF to inspect and filter all incoming WPS requests before they reach GeoServer

bash

# Configuration example - Disable WPS in GeoServer
# Navigate to GeoServer data directory and modify the WPS configuration
# Option 1: Remove the WPS extension JAR files from webapps/geoserver/WEB-INF/lib/
# Option 2: Disable WPS through the web admin interface
# GeoServer Admin > Services > WPS > Disable

# Network-level mitigation using iptables to restrict WPS access
iptables -A INPUT -p tcp --dport 8080 -m string --string "service=WPS" --algo bm -j DROP
iptables -A INPUT -p tcp --dport 8080 -m string --string "/wps" --algo bm -j DROP