CVE-2022-24816

CVE-2022-24816 is a critical (CVSS 3.1: 10.0) code injection flaw (CWE-94) in JAI-EXT, the open-source library that extends the Java Advanced Imaging (JAI) API. When an application allows Jiffle scripts to be submitted over a network request — most notably the downstream OSGeo GeoServer GIS server — the script is compiled into Java code using Janino and then executed, letting an attacker inject malicious code into the compiled script. Because the attack requires no privileges or user interaction and crosses security scopes, an unauthenticated attacker gains remote code execution on the server with the application's privileges. Any deployment of JAI-EXT prior to version 1.2.22 that accepts Jiffle scripts from network requests is affected, with GeoServer instances being the primary exposure. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2024-06-26 and carries a 98.5% EPSS score (100th percentile), indicating active exploitation in the wild, though no public proof-of-concept is known.

What to do: Upgrade JAI-EXT to version 1.2.22 or later, which disables the ability to inject code into the compiled Jiffle script — for GeoServer operators this means moving to a GeoServer release that ships the patched JAI-EXT. If upgrading is not immediately possible, remove janino-x.y.z.jar from the application classpath so Jiffle scripts cannot be compiled at all. Per the CISA KEV listing (added 2024-06-26), apply these mitigations per vendor instructions or discontinue use, and check internet-facing GeoServer/WPS endpoints for signs of Jiffle-based code injection.