CVE-2023-51445: 
Java vulnerability analysis and mitigation

GeoServer, an open source software server written in Java for sharing and editing geospatial data, contains a stored cross-site scripting (XSS) vulnerability (CVE-2023-51445) in versions prior to 2.23.3 and 2.24.0. The vulnerability enables an authenticated administrator with workspace-level privileges to store a JavaScript payload in uploaded style/legend resources that can execute in another administrator's browser when viewed in the REST Resources API (GitHub Advisory).

The vulnerability allows an attacker to upload malicious files either through the New Style page or directly via PUT requests to the REST API. When these files are later viewed through the REST Resources API, the malicious JavaScript executes in the context of the viewing administrator's browser. The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (GitHub Advisory).

If successfully exploited, an attacker can perform any actions within the application that the victim user can perform, view and modify information accessible to the victim user, and initiate interactions with other application users that appear to originate from the victim. The vulnerability is particularly concerning as it could be used to steal user cookies since they don't use HTTPOnly flag (GitHub Advisory).

The vulnerability requires an authenticated administrator with workspace-level privileges to exploit. The attacker must first upload a malicious file containing JavaScript payload through either the New Style page or via PUT requests to the REST API. The payload executes when another administrator views the file through the REST Resources API. Access to the REST Resources API is limited to full administrators by default (GitHub Advisory).

The vulnerability has been patched in versions 2.23.3 and 2.24.0. Organizations should upgrade to these or newer versions. Additionally, administrators should carefully consider granting non-administrators access to the REST Resources API endpoint as it may allow access to files containing sensitive information (GitHub Advisory).