Vulnerability Details : CVE-2022-24818
GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings.
Vulnerability category: Input validation
Products affected by CVE-2022-24818
- cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*
- cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*
- cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2022-24818
0.14%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 50 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2022-24818
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
7.5
|
HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
10.0
|
6.4
|
NIST | |
|
7.2
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
1.2
|
5.9
|
NIST | |
|
8.2
|
HIGH | CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H |
1.5
|
6.0
|
GitHub, Inc. |
CWE ids for CVE-2022-24818
-
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.Assigned by: security-advisories@github.com (Secondary)
-
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.Assigned by: nvd@nist.gov (Primary)
References for CVE-2022-24818
-
https://github.com/geotools/geotools/commit/4f70fa3234391dd0cda883a20ab0ec75688cba49
[GEOT-7115] Streamline JNDI lookups · geotools/geotools@4f70fa3 · GitHubPatch;Third Party Advisory
-
https://github.com/geotools/geotools/security/advisories/GHSA-jvh2-668r-g75x
Unchecked JNDI lookups in GeoTools · Advisory · geotools/geotools · GitHubThird Party Advisory
Jump to