CVE-2024-23634: 
Java vulnerability analysis and mitigation

An arbitrary file renaming vulnerability (CVE-2024-23634) affects GeoServer versions prior to 2.23.5 and 2.24.2. The vulnerability exists in the REST Coverage Store and Data Store API, allowing authenticated administrators with permissions to modify stores to rename arbitrary files and directories that don't end in '.zip'. The vulnerability was discovered and reported by sikeoka, with the fix being implemented in January 2024 (GitHub Advisory).

The vulnerability occurs during store file uploads when the system renames zip files to have a '.zip' extension if they don't already have one before unzipping. While this process is safe for file and URL upload methods where files are contained in specific subdirectories of the data directory, the external upload method allows for arbitrary file and directory renaming. The vulnerability has been assigned a CVSS v3.1 score of 6.0 (Moderate) with the following vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H (GitHub Advisory).

The vulnerability can lead to various impacts including denial of service by preventing GeoServer from running or effectively deleting specific resources such as workspaces, layers, or styles. In some cases, renaming GeoServer files could revert to default settings, ranging from harmless changes like removing contact information to more serious consequences such as allowing unauthorized OGC requests. For non-GeoServer files, the impact depends on the specific environment, though denial of service is a likely outcome (GitHub Advisory).

The vulnerability can be exploited through the REST API using either Coverage Store or Data Store endpoints. An example exploit involves using a curl command with PUT request, specifying 'application/zip' as the Content-Type, and providing the path to the file to be moved. Authentication as an administrator with appropriate permissions is required for exploitation (GitHub Advisory).

Users should upgrade to GeoServer versions 2.23.5 or 2.24.2 or later, which contain the fix for this vulnerability. The fix prevents arbitrary file renaming and implements proper validation for external file uploads (GitHub Advisory).