Unchecked JNDI lookups in GeoTools

Vulnerability

The GeoTools library (versions prior to 26.4, 25.6, and 24.6) contains multiple data sources that can perform unchecked JNDI lookups. This vulnerability, similar to the Log4J case, allows an attacker to trigger class deserialization when JNDI names are user-provided. However, the attack requires admin-level login to be triggered. The affected versions are all versions before the patched releases: GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6 [1][2].

Exploitation

An attacker needs to have admin-level access to a downstream application (such as GeoServer) to provide a malicious JNDI string via the user interface or REST configuration. No further authentication is required beyond that admin access. The attack does not require user interaction if the admin is tricked or if the vulnerability is reached through legitimate but attacker-controlled input. The exact steps include: an attacker with admin credentials supplies a crafted JNDI name (e.g., with an LDAP or other scheme), which is then looked up by GeoTools, leading to deserialization of remote classes and potential arbitrary code execution [1][2].

Impact

Successful exploitation results in arbitrary code execution (RCE) on the server running the downstream application. This gives the attacker full control over the affected system, including the ability to read, modify, or delete data, install malware, or pivot to other systems. The compromise occurs at the privilege level of the application process [1][2].

Mitigation

The vulnerability is fixed in GeoTools versions 26.4, 25.6, and 24.6 (published 2022-04-13). Users should upgrade to these patched versions immediately. The fix restricts JNDI lookups to only allow the java scheme or no scheme, rejecting other schemes like LDAP [1][2]. For users unable to upgrade, a workaround is to ensure that downstream applications (e.g., GeoServer) do not allow usage of remotely provided JNDI strings; specifically, make the GUI and REST configuration unreachable from remote hosts [2].