JAI-EXT代码注入漏洞

详细信息

漏洞类型

代码注入

漏洞描述

JAI-EXT是一个开源项目，旨在扩展Java高级成像(JAI)API。因为Jiffle脚本通过Janino编译成Java代码并执行，当程序使用jt-jiffle并允许通过网络请求提供jiffle脚本时，该漏洞可能导致远程代码执行。漏洞会会影响下游的GeoServer项目。

修复建议

有关修补程序、升级或建议的解决方法信息，请参阅JAI-EXT GIT存储库。参考链接： https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb

缓解措施

通过janino-x.y.z.jar从类路径中删除Jiffle脚本，取消从最终应用程序编译Jiffle脚本的能力。

参考链接

• https://github.com/advisories/GHSA-v92f-jx6p-73rx

  GitHub

• https://github.com/geosolutions-it/jai-ext

  OSV

• https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb

  OSV · x_refsource_MISC

• https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx

  OSV · x_refsource_CONFIRM

• https://nvd.nist.gov/vuln/detail/CVE-2022-24816

  OSV

• https://osv.dev/vulnerability/CVE-2022-24816

  OSV

• https://osv.dev/vulnerability/GHSA-v92f-jx6p-73rx

  OSV

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24816

  NVD

• https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/24xxx/CVE-2022-24816.json

  OSV