CVE-2023-41339
📋 TL;DR
This CVE allows attackers to perform Server-Side Request Forgery (SSRF) attacks against GeoServer instances with dynamic styling enabled but without URL validation. Attackers can exploit this to steal NetNTLMv2 hashes from Windows systems, which could be cracked or relayed for further network access. All GeoServer instances with dynamic styling enabled and lacking URL checks are affected.
💻 Affected Systems
- GeoServer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain access to internal network resources, steal credentials via NetNTLMv2 hash capture, and potentially achieve lateral movement or domain compromise.
Likely Case
Attackers exfiltrate NetNTLMv2 hashes from Windows systems, which could be cracked offline or used in relay attacks to access internal services.
If Mitigated
Limited to information disclosure about internal network services if URL validation blocks external requests.
🎯 Exploit Status
Exploitation requires sending crafted WMS requests with malicious SLD parameters. No authentication needed if GeoServer endpoints are publicly accessible.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.22.5 or 2.23.2
Vendor Advisory: https://github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmf
Restart Required: Yes
Instructions:
1. Download GeoServer 2.22.5 or 2.23.2 from official releases. 2. Backup current configuration. 3. Stop GeoServer service. 4. Replace with patched version. 5. Restart GeoServer service.
🔧 Temporary Workarounds
Disable dynamic styling
allDisable the use of dynamic SLD styles in GeoServer configuration
Edit web.xml to remove or comment out SLDService parameters
Set 'allowDynamicStyling' to false in WMS settings
Implement URL validation
allConfigure GeoServer to validate SLD URLs against allowed domains
Configure 'sldUrlCheck' filter in web.xml with allowed domains
🧯 If You Can't Patch
- Disable dynamic styling completely in GeoServer configuration
- Implement network segmentation to restrict GeoServer's outbound HTTP requests
🔍 How to Verify
Check if Vulnerable:
Check if dynamic styling is enabled without URL validation in GeoServer WMS settings and version is below 2.22.5/2.23.2Check Version:
Check GeoServer web interface admin panel or examine geoserver.war versionVerify Fix Applied:
Verify GeoServer version is 2.22.5 or 2.23.2+ and test that SLD URL validation is enforced📡 Detection & Monitoring
Log Indicators:
- Unusual SLD parameter requests in GeoServer logs
- HTTP requests to internal resources from GeoServer
Network Indicators:
- GeoServer making unexpected outbound HTTP requests
- SMB authentication attempts from GeoServer to internal systems
SIEM Query:
source="geoserver" AND (sld=* OR SLD=*) AND url=*🔗 References
- https://github.com/geoserver/geoserver/releases/tag/2.22.5
- https://github.com/geoserver/geoserver/releases/tag/2.23.2
- https://github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmf
- https://github.com/geoserver/geoserver/releases/tag/2.22.5
- https://github.com/geoserver/geoserver/releases/tag/2.23.2
- https://github.com/geoserver/geoserver/security/advisories/GHSA-cqpc-x2c6-2gmf
