OSGeo GeoServer JAI-EXT Code Injection Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 26/06/2024. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| it.geosolutions.jaiext.jiffle:jt-jiffle | < 1.1.22 | 1.1.22 |
| it.geosolutions.jaiext.jiffle:jt-jiffle-language | < 1.1.22 | 1.1.22 |
| jai-ext | < 1.1.22 | 1.1.22 |
Programs using jt-jiffle, and allowing Jiffle script to be provided via network request, are susceptible to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project.
Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script.
Negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
None.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free