Description
GeoServer是一个功能齐全,遵循OGC开放标准的开源WFS-T和WMS服务器。CVE-2022-24816中，攻击者可构造恶意请求，在无需登录的情况下提供恶意的jiffle，从而执行任意java代码，控制服务器。
GeoServer Jiffle 远程代码执行漏洞
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://geoserver.org/vulnerability/2022/04/11/geoserver-2-jiffle-jndi-rce.html
https://avd.aliyun.com/detail?id=AVD-2022-24816
https://nvd.nist.gov/vuln/detail/CVE-2022-24816
https://synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver
https://www.rapid7.com/db/vulnerabilities/geosolutions-jiffle-cve-2022-24816/
https://github.com/Threekiii/Awesome-POC/blob/master/%E4%B8%AD%E9%97%B4%E4%BB%B6%E6%BC%8F%E6%B4%9E/GeoServer%20JAI-EXT%20%E5%AF%BC%E8%87%B4%E8%BF%9C%E7%A8%8B%E4%BB%A3%E7%A0%81%E6%B3%A8%E5%85%A5%E6%BC%8F%E6%B4%9E%20CVE-2022-24816%20CVE-2023-35042.md
https://www.keysight.com/blogs/en/tech/nwvs/2024/09/03/cve-2022-24816-code-injection-vulnerability-geoserver
https://threatprotect.qualys.com/2023/03/03/jai-ext-remote-code-execution-vulnerability-cve-2022-24816/
https://www.sentinelone.com/vulnerability-database/cve-2022-24816/
https://zone.ci/aliyun/ali_nvd/62922.html