Threats affecting pkg:github/geonetwork/core-geonetwork

GeoNetwork core-geonetwork versions prior to 4.2.17 and 4.4.12 contain a server-side request forgery (SSRF) vulnerability in the POST /api/tools/ogc/sld endpoint. This endpoint accepted a user-supplied WMS server URL and performed an HTTP GET request without validating the destination. An anonymous attacker could exploit this to make the server send requests to internal, non-publicly reachable hosts. If the response was XML, the server could store and return the fetched content, enabling internal data disclosure, authorization bypass, and network reconnaissance. The vulnerability is fixed in versions 4.2.17 and 4.4.12.

GeoNetwork is a catalog application to manage spatially referenced resources. From 3.12.0 until 4.2.16 and 4.4.11, unsafe redirect validation in GeonetworkOAuth2LoginAuthenticationFilter and KeycloakAuthenticationProcessingFilter permits an attacker-controlled external redirect after login. This issue is fixed in versions 4.2.16 and 4.4.11.

GeoServer is an open source server that allows users to share and edit geospatial data. GeoTools Schema class use of Eclipse XSD library to represent schema data structure is vulnerable to XML External Entity (XXE) exploit. This impacts whoever exposes XML processing with gt-xsd-core involved in parsing, when the documents carry a reference to an external XML schema. The gt-xsd-core Schemas class is not using the EntityResolver provided by the ParserHandler (if any was configured). This also impacts users of gt-wfs-ng DataStore where the ENTITY_RESOLVER connection parameter was not being used as intended. This vulnerability is fixed in GeoTools 33.1, 32.3, 31.7, and 28.6.1, GeoServer 2.27.1, 2.26.3, and 2.25.7, and GeoNetwork 4.4.8 and 4.2.13.