GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. The application is using a whitelist, but the whitelist can be bypassed. The bypass will trick the application that the first host is a whitelisted address, but the browser will use `@` or `%40` as a credential to the host geoserver on port 8080, this will return the data to that host on the response. Version 4.1.3.post1 is the first available version that contains a patch.
References
| Link | Resource |
|---|---|
| https://github.com/GeoNode/geonode/commit/79ac6e70419c2e0261548bed91c159b54ff35b8d | Patch |
| https://github.com/GeoNode/geonode/releases/tag/4.1.3 | Release Notes |
| https://github.com/GeoNode/geonode/security/advisories/GHSA-pxg5-h34r-7q8p | Exploit Third Party Advisory |
| https://github.com/GeoNode/geonode/commit/79ac6e70419c2e0261548bed91c159b54ff35b8d | Patch |
| https://github.com/GeoNode/geonode/releases/tag/4.1.3 | Release Notes |
| https://github.com/GeoNode/geonode/security/advisories/GHSA-pxg5-h34r-7q8p | Exploit Third Party Advisory |
Configurations
History
21 Nov 2024, 08:22
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 7.5 |
| References | () https://github.com/GeoNode/geonode/commit/79ac6e70419c2e0261548bed91c159b54ff35b8d - Patch | |
| References | () https://github.com/GeoNode/geonode/releases/tag/4.1.3 - Release Notes | |
| References | () https://github.com/GeoNode/geonode/security/advisories/GHSA-pxg5-h34r-7q8p - Exploit, Third Party Advisory |
04 Nov 2023, 02:00
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/GeoNode/geonode/commit/79ac6e70419c2e0261548bed91c159b54ff35b8d - Patch | |
| References | (MISC) https://github.com/GeoNode/geonode/releases/tag/4.1.3 - Release Notes |
20 Sep 2023, 20:15
| Type | Values Removed | Values Added |
|---|---|---|
| Summary | GeoNode is an open source platform that facilitates the creation, sharing, and collaborative use of geospatial data. A SSRF vulnerability exists starting in version 3.2.0, bypassing existing controls on the software. This can allow a user to request internal services for a full read SSRF, returning any data from the internal network. The application is using a whitelist, but the whitelist can be bypassed. The bypass will trick the application that the first host is a whitelisted address, but the browser will use `@` or `%40` as a credential to the host geoserver on port 8080, this will return the data to that host on the response. Version 4.1.3.post1 is the first available version that contains a patch. | |
| References |
|
20 Sep 2023, 15:08
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) https://github.com/GeoNode/geonode/security/advisories/GHSA-pxg5-h34r-7q8p - Exploit, Third Party Advisory | |
| CPE | cpe:2.3:a:geosolutionsgroup:geonode:*:*:*:*:*:*:*:* | |
| First Time |
Geosolutionsgroup
Geosolutionsgroup geonode |
|
| CVSS |
v2 : v3 : |
v2 : unknown
v3 : 6.5 |
17 Sep 2023, 12:01
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2023-09-15 21:15
Updated : 2024-11-21 08:22
NVD link : CVE-2023-42439
Mitre link : CVE-2023-42439
CVE.ORG link : CVE-2023-42439
JSON object : View
Products Affected
geosolutionsgroup
- geonode
CWE
CWE-918
Server-Side Request Forgery (SSRF)