AI analysis
GeoNetwork, the open-source catalog application for managing spatially referenced resources, is affected by a missing-authorization flaw (CWE-862) in the API endpoint used to create new formatters, which leaves its file upload unprotected in versions prior to 4.4.12 and 4.2.17. An unauthenticated attacker with network access to the API can upload arbitrary .xsl or .zip formatter files. This allows the attacker to write arbitrary files into the GeoNetwork formatter directory, an unauthorized write to server storage that the CVSS scores as a high-integrity, scope-changing impact, and related news coverage reports the issue being chained into unauthenticated remote code execution on government geoportal backends. Any deployment running GeoNetwork 4.4.x prior to 4.4.12 or 4.2.x prior to 4.2.17 where the formatter creation endpoint is reachable, particularly internet-exposed geoportals, is affected. No in-the-wild exploitation, public proof-of-concept, or KEV listing is currently known, and EPSS estimates roughly a 0.5% probability of exploitation within 30 days.
What to do: Upgrade to GeoNetwork 4.4.12 or 4.2.17 as applicable. Until patched, restrict access to the formatter creation API (for example by requiring authentication or blocking the endpoint at a reverse proxy) and inspect the GeoNetwork formatter directory for unexpected .xsl or .zip files, since related coverage indicates the file write can be chained into remote code execution.
Affected
| GeoNetwork (GeoNetwork opensource project) GeoNetwork | 4.4.x prior to 4.4.12 |
| GeoNetwork (GeoNetwork opensource project) GeoNetwork | 4.2.x prior to 4.2.17 |
Estimated exposure
moderate≈1,000–10,000 instances worldwide, many of them internet-exposed government and SDI geoportals — GeoNetwork publishes no active-install counts, so this order-of-magnitude estimate is based on the project's role as a widely adopted open-source spatial data catalog for national mapping agencies, UN bodies, and government geoportals,…
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files. An unauthenticated attacker can upload arbitrary `.xsl` or `.zip` formatter files to the server. An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage. The issue is patched in GeoNetwork versions 4.4.12 and 4.2.17.