CVE-2024-34696

{"id": "CVE-2024-34696", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 0.9}]}, "published": "2024-07-01T15:15:16.907", "references": [{"url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-j59v-vgcr-hxvf", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}, {"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "GeoServer is an open source server that allows users to share and edit geospatial data. Starting in version 2.10.0 and prior to versions 2.24.4 and 2.25.1, GeoServer's Server Status page and REST API lists all environment variables and Java properties to any GeoServer user with administrative rights as part of those modules' status message. These variables/properties can also contain sensitive information, such as database passwords or API keys/tokens. Additionally, many community-developed GeoServer container images `export` other credentials from their start-up scripts as environment variables to the GeoServer (`java`) process. The precise scope of the issue depends on which container image is used and how it is configured.\n\nThe `about status` API endpoint which powers the Server Status page is only available to administrators.Depending on the operating environment, administrators might have legitimate access to credentials in other ways, but this issue defeats more sophisticated controls (like break-glass access to secrets or role accounts).By default, GeoServer only allows same-origin authenticated API access. This limits the scope for a third-party attacker to use an administrator\u2019s credentials to gain access to credentials. The researchers who found the vulnerability were unable to determine any other conditions under which the GeoServer REST API may be available more broadly.\n\nUsers should update container images to use GeoServer 2.24.4 or 2.25.1 to get the bug fix. As a workaround, leave environment variables and Java system properties hidden by default. Those who provide the option to re-enable it should communicate the impact and risks so that users can make an informed choice."}, {"lang": "es", "value": "GeoServer es un servidor de c\u00f3digo abierto que permite a los usuarios compartir y editar datos geoespaciales. A partir de la versi\u00f3n 2.10.0 y antes de las versiones 2.24.4 y 2.25.1, la p\u00e1gina Estado del servidor de GeoServer y la API REST enumeran todas las variables de entorno y propiedades de Java para cualquier usuario de GeoServer con derechos administrativos como parte del mensaje de estado de esos m\u00f3dulos. Estas variables/propiedades tambi\u00e9n pueden contener informaci\u00f3n confidencial, como contrase\u00f1as de bases de datos o keys/tokens API. Adem\u00e1s, muchas im\u00e1genes de contenedores de GeoServer desarrolladas por la comunidad \"exportan\" otras credenciales desde sus scripts de inicio como variables de entorno al proceso de GeoServer (\"java\"). El alcance preciso del problema depende de qu\u00e9 imagen de contenedor se utiliza y c\u00f3mo est\u00e1 configurada. El endpoint API \"acerca del estado\" que impulsa la p\u00e1gina Estado del servidor solo est\u00e1 disponible para los administradores. Dependiendo del entorno operativo, los administradores pueden tener acceso leg\u00edtimo a las credenciales de otras maneras, pero este problema anula controles m\u00e1s sofisticados (como el acceso sin barreras a secretos o cuentas de rol). De forma predeterminada, GeoServer solo permite el acceso API autenticado del mismo origen. Esto limita las posibilidades de que un atacante externo utilice las credenciales de un administrador para obtener acceso a las credenciales. Los investigadores que encontraron la vulnerabilidad no pudieron determinar otras condiciones bajo las cuales la API REST de GeoServer pueda estar disponible de manera m\u00e1s amplia. Los usuarios deben actualizar las im\u00e1genes del contenedor para usar GeoServer 2.24.4 o 2.25.1 para corregir el error. Como workaround, deje las variables de entorno y las propiedades del sistema Java ocultas de forma predeterminada. Quienes brinden la opci\u00f3n de volver a habilitarlo deben comunicar el impacto y los riesgos para que los usuarios puedan tomar una decisi\u00f3n informada."}], "lastModified": "2024-07-03T14:42:49.743", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "779270D7-89BA-47CA-A5E5-4539668BC18E", "versionEndExcluding": "2.24.4", "versionStartIncluding": "2.10.0"}, {"criteria": "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F63F5E42-FB6D-4264-BF8A-17DEB863054C", "versionEndExcluding": "2.25.1", "versionStartIncluding": "2.25.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}