CVE-2024-34696: 
Java vulnerability analysis and mitigation

GeoServer's Server Status page and REST API vulnerability (CVE-2024-34696) affects versions from 2.10.0 up to (excluding) 2.24.4 and 2.25.1. The vulnerability exposes environment variables and Java properties containing sensitive information such as database passwords and API keys/tokens to any GeoServer user with administrative rights (GitHub Advisory).

The vulnerability exists in the Server Status page and REST API endpoint (/geoserver/rest/about/status) which displays all environment variables and Java properties to users with administrative access. The issue has a CVSS v3.1 base score of 4.9 (Medium) with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N, indicating network attack vector, low complexity, high privileges required, no user interaction needed, unchanged scope, and high confidentiality impact (NVD).

The vulnerability can expose sensitive information including database passwords, API keys/tokens, GeoServer admin and master passwords, Tomcat management passwords, HTTPS/TLS certificate keystore passwords, and AWS S3 bucket access keys. While only administrators can access this information, it bypasses more sophisticated security controls like break-glass access to secrets or role accounts (GitHub Advisory).

The vulnerability requires administrative access to exploit. By default, GeoServer only allows same-origin authenticated API access, which limits the scope for third-party attackers to use administrator credentials to access sensitive information. The researchers were unable to identify other conditions that would make the GeoServer REST API more broadly accessible (GitHub Advisory).

The vulnerability has been patched in GeoServer versions 2.24.4 and 2.25.1, which hide all environment variables and Java system properties by default. Administrators are strongly recommended to leave these settings unchanged and use alternative mechanisms to access environment variables. For container/Docker image maintainers, it's recommended to update to the patched versions and implement defense-in-depth measures like passing secrets as files, using cloud provider secret management, and clearing sensitive environment variables before starting GeoServer (GitHub Advisory).