CVE-2022-24816
OSGeo GeoServer JAI-EXT Code Injection Vulnerability
Description
CVE-2022-24816 is a critical remote code execution vulnerability in OSGeo JAI-EXT, an open-source library that extends the Java Advanced Imaging (JAI) API. The flaw allows unauthenticated attackers to execute arbitrary code on the server by submitting malicious Jiffle map algebra scripts through network requests. With a maximum CVSS v3.1 score of 10.0, this vulnerability is particularly dangerous because it affects the widely-deployed GeoServer geospatial data platform. CISA added CVE-2022-24816 to the Known Exploited Vulnerabilities catalog with a remediation deadline of July 17, 2024, and its EPSS score of 94.02% at the 99.9th percentile confirms nearly universal exploitation activity.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| geosolutionsgroup | jai-ext | < 1.1.22 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb(Patch)
- https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx(Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24816(US Government Resource)
Weakness Type
No specific CWE has been assigned to CVE-2022-24816, but the vulnerability is a code injection flaw that typically corresponds to CWE-94 (Improper Control of Generation of Code). The root cause lies in the Jiffle map algebra language implementation within JAI-EXT. Jiffle scripts are compiled into Java code at runtime using the Janino compiler library. The vulnerability allows an attacker to inject arbitrary Java code into a Jiffle script, which is then compiled and executed on the server with the full privileges of the application. This compilation-based execution path means there is no sandboxing or restriction on what the injected code can do.
Impact Analysis
CVE-2022-24816 achieves the maximum possible CVSS score of 10.0 with a network attack vector (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and changed scope (S:C). Confidentiality (High): an attacker can read any data accessible to the server process, including database credentials, configuration files, internal network resources, and geospatial data that may contain sensitive location information. Integrity (High): the attacker can modify server files, inject backdoors, alter geospatial data integrity, and pivot to other systems on the network. Availability (High): the attacker can shut down the service, consume server resources, encrypt files, or destroy data entirely. The Changed Scope (S:C) means the attacker can escape the vulnerable component's security boundary and affect other systems. The EPSS score of 94.02% at the 99.9th percentile places this among the top 0.1% of all vulnerabilities by exploitation probability. GeoServer installations are often internet-facing to serve map tiles and geospatial data to web applications, making them directly reachable by attackers. The ransomware status is listed as unknown, but the unauthenticated RCE capability makes ransomware deployment trivially possible.
Exploit Maturity
CVE-2022-24816 has an exceptionally mature exploit landscape reflecting its maximum severity score. CISA confirmed active exploitation by adding it to the KEV catalog with a remediation deadline of July 17, 2024. The EPSS score of 94.02% at the 99.9th percentile indicates near-universal exploitation, placing it among the most targeted vulnerabilities globally. The GitHub security advisory GHSA-v92f-jx6p-73rx provides full technical details. The fix commit is publicly available, and the vulnerability is addressed in JAI-EXT version 1.1.22. Because the Jiffle script injection technique is well-documented and requires only crafting an HTTP request to a GeoServer instance, the barrier to exploitation is extremely low. Automated scanning tools and exploit frameworks have incorporated this vulnerability, making mass exploitation straightforward.
Remediation
-
Upgrade JAI-EXT to version 1.1.22 or later which contains the security fix that disables the ability to inject arbitrary code through Jiffle scripts. If you are running GeoServer, update to a version that bundles the patched JAI-EXT library.
-
Update GeoServer to the latest stable release as the downstream project most commonly affected by this vulnerability. Check the GeoServer release notes for the specific version that incorporates JAI-EXT 1.1.22 or later, and apply the update across all instances.
-
Restrict network access to GeoServer and JAI-EXT-powered services by placing them behind a reverse proxy with authentication. Never expose GeoServer admin interfaces or evaluation endpoints directly to the internet without access controls.
-
Audit server logs for indicators of Jiffle script injection by searching for unusual or complex Jiffle expressions in request parameters, particularly those containing Java code constructs such as import statements, Runtime.exec() calls, or ProcessBuilder invocations.
-
Implement a web application firewall (WAF) with rules to detect and block common code injection patterns in request parameters targeting GeoServer evaluation endpoints. Block requests containing Java code patterns in Jiffle script parameters as an additional defense layer.
Technical Details
CVE-2022-24816 is a remote code execution vulnerability in OSGeo JAI-EXT with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, yielding the maximum score of 10.0 (Critical). The Attack Vector is Network (AV:N), as exploitation occurs through HTTP requests to the application. Attack Complexity is Low (AC:L), requiring only a crafted request with a malicious Jiffle script. No privileges (PR:N) and no user interaction (UI:N) are required. The Scope is Changed (S:C), meaning the attacker can affect resources beyond the vulnerable JAI-EXT library. The technical mechanism exploits the Jiffle map algebra language, which is a domain-specific language for raster map operations. JAI-EXT compiles Jiffle scripts into Java bytecode at runtime using the Janino embedded Java compiler. The vulnerability exists because Jiffle script input is not sanitized or restricted before compilation. An attacker can embed arbitrary Java code within a Jiffle script expression, which Janino compiles and executes directly on the server. This is equivalent to having a direct code execution endpoint. In GeoServer deployments, Jiffle scripts can be submitted through various OGC service endpoints (WMS, WCS, WPS), making the attack surface broad. The fix in JAI-EXT 1.1.22 restricts the code that can be generated from Jiffle scripts, preventing arbitrary Java code injection.
Frequently Asked Questions
Is CVE-2022-24816 being actively exploited?
Yes. CISA has confirmed active exploitation and added CVE-2022-24816 to the KEV catalog. Its EPSS score of 94.02% at the 99.9th percentile makes it one of the most exploited vulnerabilities in existence, with automated scanning and exploitation occurring at a massive scale.
What is the relationship between JAI-EXT and GeoServer?
JAI-EXT is a library that extends the Java Advanced Imaging API, and GeoServer is its most prominent downstream consumer. GeoServer uses JAI-EXT for raster image processing and map algebra operations. The vulnerability in JAI-EXT is exploitable through GeoServer's public-facing OGC service endpoints.
How severe is CVE-2022-24816?
CVE-2022-24816 has the maximum possible CVSS score of 10.0 (Critical). It allows unauthenticated remote code execution with changed scope, meaning an attacker can fully compromise the server and potentially pivot to other systems without any credentials or user interaction.
How do I fix CVE-2022-24816?
Upgrade JAI-EXT to version 1.1.22 or later. If running GeoServer, update to a version that includes the patched JAI-EXT library. Additionally, restrict network access to GeoServer instances and implement WAF rules to block code injection patterns in Jiffle script parameters.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.