CVE-2024-23634

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-23634
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23634.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-23634
Aliases
Published
2024-03-20T15:22:41Z
Modified
2026-08-12T15:15:01Z
Severity
  • 6.0 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H CVSS Calculator
Summary
GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API
Details

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file renaming vulnerability exists in versions prior to 2.23.5 and 2.24.2 that enables an authenticated administrator with permissions to modify stores through the REST Coverage Store or Data Store API to rename arbitrary files and directories with a name that does not end in .zip. Store file uploads rename zip files to have a .zip extension if it doesn't already have one before unzipping the file. This is fine for file and url upload methods where the files will be in a specific subdirectory of the data directory but, when using the external upload method, this allows arbitrary files and directories to be renamed. Renaming GeoServer files will most likely result in a denial of service, either completely preventing GeoServer from running or effectively deleting specific resources (such as a workspace, layer or style). In some cases, renaming GeoServer files could revert to the default settings for that file which could be relatively harmless like removing contact information or have more serious consequences like allowing users to make OGC requests that the customized settings would have prevented them from making. The impact of renaming non-GeoServer files depends on the specific environment although some sort of denial of service is a likely outcome. Versions 2.23.5 and 2.24.2 contain a fix for this issue.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-20",
        "CWE-73"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23634.json"
}
References

Affected packages

Git / github.com/geoserver/geoserver

Affected ranges

Type
GIT
Repo
https://github.com/geoserver/geoserver
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
dd453d9885d1b849d7f94870d70a281dcbded66b
Introduced
a6665cb505d45b639e62ff178b507914d089a28b
Fixed
38149ac65b5f3a6918bbc1efef8916668a1a1424
Fixed
5d6af2f8ba9ad7dffae59575504a867159698772
Fixed
c37f58fbacdfa0d581a6f99195585f70b1201f0a
Database specific
Show details 
{
    "cpe": "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.23.5"
        },
        {
            "introduced": "2.24.0"
        },
        {
            "fixed": "2.24.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ]
}

Affected versions

2.*
2.11-beta
2.21-M0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23634.json"
vanir_signatures 
[
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "40313187776103254896727845383667033520",
                "13979668228546449666876540866456883494",
                "293751470903119420398145520708253151046",
                "222128668399956771288253073925115984382",
                "62084145570612783251514350496432931536",
                "178237577260597254506289428744117046603",
                "158807250828886911017850027274368474281",
                "160141527766039263095602284842037767477",
                "12510773575361966414901861595362533768",
                "252238372400096061244818884915029638898",
                "188172802370445578176390462488447293450",
                "73305526713299221546179504112085364650",
                "178640725106781040260676813457509524980",
                "110285720539145656095082768318509886610",
                "217178318716514414085013942689427300570",
                "96671286086813672606897733760851523449",
                "139428794213295010832602925953374401526",
                "247315463457923246686713546243074777016",
                "98864005951721235014921922750038928557",
                "172858582011894350515503628469914466774",
                "310031149792020776858439504000386387247",
                "309869079396867762560934273077079548746",
                "38084103606269357942233858568095345522",
                "33549082759642156556829694966198608342",
                "296278039906272251835155263313125576952",
                "123519770131311333240296009758769010618",
                "10995677455607459459260359557521367294"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-23634-03386a01",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/AbstractStoreUploadController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "86275695787738459461844207159485034571",
            "length": 231
        },
        "id": "CVE-2024-23634-0dcedf2b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772",
        "target": {
            "file": "src/restconfig/src/test/java/org/geoserver/rest/catalog/CoverageStoreFileUploadTest.java",
            "function": "cleanup"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "304577617074976851878019815861544619751",
            "length": 513
        },
        "id": "CVE-2024-23634-43e1390b",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/CoverageStoreFileController.java",
            "function": "doFileUpload"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "304577617074976851878019815861544619751",
            "length": 513
        },
        "id": "CVE-2024-23634-5148fdd0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/CoverageStoreFileController.java",
            "function": "doFileUpload"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "154335872636005989907128810965162670284",
            "length": 469
        },
        "id": "CVE-2024-23634-5e9b53c0",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/DataStoreFileController.java",
            "function": "doFileUpload"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "18932318375731399441328034578831121629",
            "length": 92
        },
        "id": "CVE-2024-23634-6bc1966e",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772",
        "target": {
            "file": "src/restconfig/src/test/java/org/geoserver/rest/catalog/DataStoreFileUploadTest.java",
            "function": "removePdsDataStore"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "52519544737694042764404101977828132795",
            "length": 1926
        },
        "id": "CVE-2024-23634-7d9f4432",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/AbstractStoreUploadController.java",
            "function": "handleFileUpload"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "86275695787738459461844207159485034571",
            "length": 231
        },
        "id": "CVE-2024-23634-80827e73",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a",
        "target": {
            "file": "src/restconfig/src/test/java/org/geoserver/rest/catalog/CoverageStoreFileUploadTest.java",
            "function": "cleanup"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "40313187776103254896727845383667033520",
                "13979668228546449666876540866456883494",
                "293751470903119420398145520708253151046",
                "222128668399956771288253073925115984382",
                "62084145570612783251514350496432931536",
                "178237577260597254506289428744117046603",
                "158807250828886911017850027274368474281",
                "160141527766039263095602284842037767477",
                "12510773575361966414901861595362533768",
                "252238372400096061244818884915029638898",
                "188172802370445578176390462488447293450",
                "73305526713299221546179504112085364650",
                "178640725106781040260676813457509524980",
                "110285720539145656095082768318509886610",
                "217178318716514414085013942689427300570",
                "96671286086813672606897733760851523449",
                "139428794213295010832602925953374401526",
                "247315463457923246686713546243074777016",
                "98864005951721235014921922750038928557",
                "172858582011894350515503628469914466774",
                "310031149792020776858439504000386387247",
                "309869079396867762560934273077079548746",
                "38084103606269357942233858568095345522",
                "33549082759642156556829694966198608342",
                "296278039906272251835155263313125576952",
                "123519770131311333240296009758769010618",
                "10995677455607459459260359557521367294"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-23634-869bb5e7",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/AbstractStoreUploadController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "309082426858126745210650183439115166340",
                "337361034561884298350907013984369937557",
                "297555306000483314458677289185799031534",
                "207765718480241857536744482334082175977",
                "180959243290229562156925271101821567892",
                "33645431657449214843451952930266866142",
                "123125170087854378478761696600871365451",
                "219190428602993442583198115084971440879",
                "164053654295194152301370094059832537300",
                "119837218509585155410036936744345310262",
                "65663234372048241825274240893100316754",
                "339076430051510287774542233218545823053",
                "114542353126876902015714273126632776390",
                "315097709803096193438640768470227661372",
                "293742937782066362725299969568735293992",
                "118116596754964937007541100351445974796",
                "48743238537823372498977714457328973232",
                "92524916327103454008028240252080456239",
                "272868879292993357072175028411143143521"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-23634-8945e011",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a",
        "target": {
            "file": "src/restconfig/src/test/java/org/geoserver/rest/catalog/CoverageStoreFileUploadTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "309082426858126745210650183439115166340",
                "337361034561884298350907013984369937557",
                "297555306000483314458677289185799031534",
                "207765718480241857536744482334082175977",
                "180959243290229562156925271101821567892",
                "33645431657449214843451952930266866142",
                "123125170087854378478761696600871365451",
                "57407527970140592538036992426043816526",
                "72354321663219879367443667311937742404",
                "97849720754555611478617553699283052789",
                "65663234372048241825274240893100316754",
                "339076430051510287774542233218545823053",
                "114542353126876902015714273126632776390",
                "315097709803096193438640768470227661372",
                "293742937782066362725299969568735293992",
                "118116596754964937007541100351445974796",
                "48743238537823372498977714457328973232",
                "92524916327103454008028240252080456239",
                "272868879292993357072175028411143143521"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-23634-8a0109db",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772",
        "target": {
            "file": "src/restconfig/src/test/java/org/geoserver/rest/catalog/CoverageStoreFileUploadTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "308000152145964687498887134462604613375",
                "28739407125813735125245039605813116103",
                "84138084668985175020862882281334817214",
                "262292012105640346283534242848945238728",
                "260510091157561342024840793854655014723",
                "72262270920768769658983136620388815636",
                "178832585856043923031350802348296971115",
                "271832445070375282428735255476011451290",
                "126227755279730869983626248972927300667",
                "144676216191914581302609362348828138561",
                "235328647097942847447992000425802903604",
                "192022505370113240227675104113764071296",
                "90100172719394872936967057832831039608",
                "140536789106368110030557454719436228672",
                "175054402451168235474539161800841163238",
                "272258319508246045709618444968918531655",
                "69451312942480148965927424592344173613",
                "169558133343902617849012133725578202786",
                "300326112085626459695796377456318049983",
                "106552057095355301056622044481541892564",
                "160451823126351064357671100871830113734",
                "276303262881805777023545946712529757514",
                "136061910124137567564213996105619411003",
                "157789144441791475172264881216974533611",
                "216656056156860216491413768753340243218",
                "30584587213142902972153208626010345669",
                "43693651672511506419582617180681485734"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-23634-8c7c5796",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a",
        "target": {
            "file": "src/restconfig/src/test/java/org/geoserver/rest/catalog/DataStoreFileUploadTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "91323327798181873442456570359837643449",
                "8084867114817336632967888909784128186",
                "105776210922463476582948158944338495198",
                "267754557678820502087173930467786281078",
                "118514476757434660837207673169088769819",
                "6445464632285287248710585882816899384",
                "214669227369917810533352941002877196225",
                "199443556526630585375961171272746196435",
                "131939799065993605503560125497332645133",
                "112923792290780782907095569625690882350"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-23634-8e995513",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/CoverageStoreFileController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "91323327798181873442456570359837643449",
                "8084867114817336632967888909784128186",
                "105776210922463476582948158944338495198",
                "267754557678820502087173930467786281078",
                "118514476757434660837207673169088769819",
                "6445464632285287248710585882816899384",
                "214669227369917810533352941002877196225",
                "199443556526630585375961171272746196435",
                "131939799065993605503560125497332645133",
                "112923792290780782907095569625690882350"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-23634-9ca23717",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/CoverageStoreFileController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "154335872636005989907128810965162670284",
            "length": 469
        },
        "id": "CVE-2024-23634-b1815fa5",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/DataStoreFileController.java",
            "function": "doFileUpload"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "221363938807615370083651825189899870830",
                "82074158454694567288269905986252079123",
                "241651375631585082049028964955186733772",
                "160367159401448115459126041543272621598",
                "91323327798181873442456570359837643449",
                "8084867114817336632967888909784128186",
                "12925117755851544849053320092106896884",
                "217772367612432232737912997595022062583",
                "133972939248764268023344580745769109630",
                "205520534646312423111458381080927178562",
                "288351802723145432529847834005860691489",
                "227470302920656822966447970376060741761",
                "112923792290780782907095569625690882350"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-23634-b7fdae6c",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/DataStoreFileController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "52519544737694042764404101977828132795",
            "length": 1926
        },
        "id": "CVE-2024-23634-bf3872d3",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/AbstractStoreUploadController.java",
            "function": "handleFileUpload"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "308000152145964687498887134462604613375",
                "28739407125813735125245039605813116103",
                "84138084668985175020862882281334817214",
                "262292012105640346283534242848945238728",
                "260510091157561342024840793854655014723",
                "72262270920768769658983136620388815636",
                "178832585856043923031350802348296971115",
                "271832445070375282428735255476011451290",
                "126227755279730869983626248972927300667",
                "144676216191914581302609362348828138561",
                "235328647097942847447992000425802903604",
                "192022505370113240227675104113764071296",
                "90100172719394872936967057832831039608",
                "140536789106368110030557454719436228672",
                "175054402451168235474539161800841163238",
                "272258319508246045709618444968918531655",
                "69451312942480148965927424592344173613",
                "169558133343902617849012133725578202786",
                "300326112085626459695796377456318049983",
                "106552057095355301056622044481541892564",
                "160451823126351064357671100871830113734",
                "276303262881805777023545946712529757514",
                "136061910124137567564213996105619411003",
                "157789144441791475172264881216974533611",
                "216656056156860216491413768753340243218",
                "30584587213142902972153208626010345669",
                "43693651672511506419582617180681485734"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-23634-d050a1d5",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772",
        "target": {
            "file": "src/restconfig/src/test/java/org/geoserver/rest/catalog/DataStoreFileUploadTest.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "line_hashes": [
                "221363938807615370083651825189899870830",
                "107438064365831083080784942896672562117",
                "145900770807524564396713704981606538982",
                "273983865376026374117167736095524035475",
                "91323327798181873442456570359837643449",
                "8084867114817336632967888909784128186",
                "12925117755851544849053320092106896884",
                "217772367612432232737912997595022062583",
                "133972939248764268023344580745769109630",
                "205520534646312423111458381080927178562",
                "288351802723145432529847834005860691489",
                "227470302920656822966447970376060741761",
                "112923792290780782907095569625690882350"
            ],
            "threshold": 0.9
        },
        "id": "CVE-2024-23634-e45c6633",
        "signature_type": "Line",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772",
        "target": {
            "file": "src/restconfig/src/main/java/org/geoserver/rest/catalog/DataStoreFileController.java"
        }
    },
    {
        "deprecated": false,
        "digest": {
            "function_hash": "18932318375731399441328034578831121629",
            "length": 92
        },
        "id": "CVE-2024-23634-ef8b2e2d",
        "signature_type": "Function",
        "signature_version": "v1",
        "source": "https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a",
        "target": {
            "file": "src/restconfig/src/test/java/org/geoserver/rest/catalog/DataStoreFileUploadTest.java",
            "function": "removePdsDataStore"
        }
    }
]
vanir_signatures_modified 
"2026-08-12T15:15:01Z"