CVE-2024-24749

Workarounds

Change environment:

• Change from Windows operating system. This vulnerability depends on Windows file paths so Linux and Mac OS are not vulnerable.
• Change from Apache Tomcat application server. Jetty and WildFly are confirmed to not be vulnerable. Other application servers have not been tested and may be vulnerable.

Disable anonymous access to the embeded GeoWebCache administration and status pages:

1. Navigate to Security > Authentication Page
2. Locate Filter Chains heading
3. Select the web filter filter chain (ant pattern /web/**,/gwc/rest/web/**,/)
4. Remove ,/gwc/rest/web/** from the pattern (so that /web/**,/ is left).
5. Save the changes

References

• CVE-Pending

If GeoServer is deployed in the Windows operating system using an Apache Tomcat web application server, it is possible to bypass existing input validation in the GeoWebCache ByteStreamController class and read arbitrary classpath resources with specific file name extensions.

If GeoServer is also deployed as a web archive using the data directory embedded in the geoserver.war file (rather than an external data directory), it will likely be possible to read specific resources to gain administrator privileges. However, it is very unlikely that production environments will be using the embedded data directory since, depending on how GeoServer is deployed, it will be erased and re-installed (which would also reset to the default password) either every time the server restarts or every time a new GeoServer WAR is installed and is therefore difficult to maintain. An external data directory will always be used if GeoServer is running in standalone mode (via an installer or a binary).

Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.

CVE-2024-24749 has a CVSS score of 7.5 (High). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.23.5, 2.24.3); upgrading removes the vulnerable code path.

Kodem intelligence

https://github.com/GeoWebCache/geowebcache/pull/1211

1. What is CVE-2024-24749? CVE-2024-24749 is a high-severity path traversal vulnerability in org.geoserver.web:gs-web-app (maven), affecting versions < 2.23.5. It is fixed in 2.23.5, 2.24.3. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
2. How severe is CVE-2024-24749? CVE-2024-24749 has a CVSS score of 7.5 (High). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which packages are affected by CVE-2024-24749?
   • org.geoserver.web:gs-web-app (maven) (versions < 2.23.5)
   • org.geoserver:gs-gwc (maven) (versions < 2.23.5)
4. Is there a fix for CVE-2024-24749? Yes. CVE-2024-24749 is fixed in 2.23.5, 2.24.3. Upgrade to this version or later.
5. Is CVE-2024-24749 exploitable, and should I be worried? Whether CVE-2024-24749 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2024-24749 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2024-24749?
   • Upgrade org.geoserver.web:gs-web-app to 2.23.5 or later
   • Upgrade org.geoserver.web:gs-web-app to 2.24.3 or later
   • Upgrade org.geoserver:gs-gwc to 2.23.5 or later
   • Upgrade org.geoserver:gs-gwc to 2.24.3 or later