CVE-2023-41339: 
Java vulnerability analysis and mitigation

GeoServer, an open source software server written in Java for sharing and editing geospatial data, was found to contain a Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2023-41339. The vulnerability exists in the WMS specification's sld= parameter for GetMap, GetLegendGraphic, and GetFeatureInfo operations when dynamic styling is enabled without proper URL checks configuration. This vulnerability was discovered and disclosed in October 2023, affecting GeoServer versions prior to 2.22.5 and 2.23.2 (GitHub Advisory).

The vulnerability stems from the WMS specification's implementation of dynamic styling through the sld= parameter. When dynamic styling is enabled without proper URL check configurations, it creates an opportunity for Server-Side Request Forgery attacks. The vulnerability has been assigned a CVSS v3.1 base score of 8.6 (HIGH) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L, indicating network accessibility, low attack complexity, and no required privileges or user interaction (NVD).

The primary impact of this vulnerability is the potential theft of user NetNTLMv2 hashes, which could be subsequently relayed or cracked externally to gain unauthorized access to systems. The vulnerability allows for 'Blind SSRF' attacks on the WMS endpoint, particularly when WMS Settings dynamic styling is enabled and Security URL checks are either disabled or configured to allow file:* access (GitHub Advisory).

The vulnerability has been patched in GeoServer versions 2.22.5 and 2.23.2. For safe usage of dynamic styling, administrators should enable URL Checks in Security settings and configure trust for specific locations using patterns like ^https://styles\.server\.net/cartography/.*$. Alternatively, dynamic styling can be disabled entirely by navigating to Services > WMS Settings and selecting the 'Disable usage of SLD and SLD_BODY parameters in GET requests and user styles in POST' checkbox (GitHub Advisory).