{"id":"CVE-2024-23634","summary":"GeoServer arbitrary file renaming vulnerability in REST Coverage/Data Store API","details":"GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. An arbitrary file renaming vulnerability exists in versions prior to 2.23.5 and 2.24.2 that enables an authenticated administrator with permissions to modify stores through the REST Coverage Store or Data Store API to rename arbitrary files and directories with a name that does not end in `.zip`. Store file uploads rename zip files to have a `.zip` extension if it doesn't already have one before unzipping the file.  This is fine for file and url upload methods where the files will be in a specific subdirectory of the data directory but, when using the external upload method, this allows arbitrary files and directories to be renamed. Renaming GeoServer files will most likely result in a denial of service, either completely preventing GeoServer from running or effectively deleting specific resources (such as a workspace, layer or style).  In some cases, renaming GeoServer files could revert to the default settings for that file which could be relatively harmless like removing contact information or have more serious consequences like allowing users to make OGC requests that the customized settings would have prevented them from making. The impact of renaming non-GeoServer files depends on the specific environment although some sort of denial of service is a likely outcome. Versions 2.23.5 and 2.24.2 contain a fix for this issue.","aliases":["GHSA-75m5-hh4r-q9gx"],"modified":"2026-08-12T15:15:01.358750Z","published":"2024-03-20T15:22:41.431Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-20","CWE-73"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23634.json"},"references":[{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOS-11213"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/23xxx/CVE-2024-23634.json"},{"type":"ADVISORY","url":"https://github.com/geoserver/geoserver/security/advisories/GHSA-75m5-hh4r-q9gx"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23634"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a"},{"type":"FIX","url":"https://github.com/geoserver/geoserver/pull/7289"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/geoserver/geoserver","events":[{"introduced":"0"},{"fixed":"dd453d9885d1b849d7f94870d70a281dcbded66b"},{"introduced":"a6665cb505d45b639e62ff178b507914d089a28b"},{"fixed":"38149ac65b5f3a6918bbc1efef8916668a1a1424"},{"fixed":"5d6af2f8ba9ad7dffae59575504a867159698772"},{"fixed":"c37f58fbacdfa0d581a6f99195585f70b1201f0a"}],"database_specific":{"cpe":"cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*","extracted_events":[{"introduced":"0"},{"fixed":"2.23.5"},{"introduced":"2.24.0"},{"fixed":"2.24.2"}],"source":["CPE_RANGE","REFERENCES"]}}],"versions":["2.21-M0","2.11-beta"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-23634.json","vanir_signatures_modified":"2026-08-12T15:15:01Z","vanir_signatures":[{"digest":{"threshold":0.9,"line_hashes":["40313187776103254896727845383667033520","13979668228546449666876540866456883494","293751470903119420398145520708253151046","222128668399956771288253073925115984382","62084145570612783251514350496432931536","178237577260597254506289428744117046603","158807250828886911017850027274368474281","160141527766039263095602284842037767477","12510773575361966414901861595362533768","252238372400096061244818884915029638898","188172802370445578176390462488447293450","73305526713299221546179504112085364650","178640725106781040260676813457509524980","110285720539145656095082768318509886610","217178318716514414085013942689427300570","96671286086813672606897733760851523449","139428794213295010832602925953374401526","247315463457923246686713546243074777016","98864005951721235014921922750038928557","172858582011894350515503628469914466774","310031149792020776858439504000386387247","309869079396867762560934273077079548746","38084103606269357942233858568095345522","33549082759642156556829694966198608342","296278039906272251835155263313125576952","123519770131311333240296009758769010618","10995677455607459459260359557521367294"]},"id":"CVE-2024-23634-03386a01","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/AbstractStoreUploadController.java"},"deprecated":false},{"target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/catalog/CoverageStoreFileUploadTest.java","function":"cleanup"},"deprecated":false,"digest":{"function_hash":"86275695787738459461844207159485034571","length":231},"id":"CVE-2024-23634-0dcedf2b","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/CoverageStoreFileController.java","function":"doFileUpload"},"deprecated":false,"digest":{"function_hash":"304577617074976851878019815861544619751","length":513},"id":"CVE-2024-23634-43e1390b"},{"signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/CoverageStoreFileController.java","function":"doFileUpload"},"deprecated":false,"digest":{"function_hash":"304577617074976851878019815861544619751","length":513},"id":"CVE-2024-23634-5148fdd0"},{"id":"CVE-2024-23634-5e9b53c0","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/DataStoreFileController.java","function":"doFileUpload"},"deprecated":false,"digest":{"function_hash":"154335872636005989907128810965162670284","length":469}},{"id":"CVE-2024-23634-6bc1966e","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/catalog/DataStoreFileUploadTest.java","function":"removePdsDataStore"},"deprecated":false,"digest":{"function_hash":"18932318375731399441328034578831121629","length":92}},{"source":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/AbstractStoreUploadController.java","function":"handleFileUpload"},"deprecated":false,"digest":{"function_hash":"52519544737694042764404101977828132795","length":1926},"id":"CVE-2024-23634-7d9f4432","signature_type":"Function","signature_version":"v1"},{"source":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/catalog/CoverageStoreFileUploadTest.java","function":"cleanup"},"deprecated":false,"digest":{"function_hash":"86275695787738459461844207159485034571","length":231},"id":"CVE-2024-23634-80827e73","signature_type":"Function","signature_version":"v1"},{"id":"CVE-2024-23634-869bb5e7","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/AbstractStoreUploadController.java"},"deprecated":false,"digest":{"threshold":0.9,"line_hashes":["40313187776103254896727845383667033520","13979668228546449666876540866456883494","293751470903119420398145520708253151046","222128668399956771288253073925115984382","62084145570612783251514350496432931536","178237577260597254506289428744117046603","158807250828886911017850027274368474281","160141527766039263095602284842037767477","12510773575361966414901861595362533768","252238372400096061244818884915029638898","188172802370445578176390462488447293450","73305526713299221546179504112085364650","178640725106781040260676813457509524980","110285720539145656095082768318509886610","217178318716514414085013942689427300570","96671286086813672606897733760851523449","139428794213295010832602925953374401526","247315463457923246686713546243074777016","98864005951721235014921922750038928557","172858582011894350515503628469914466774","310031149792020776858439504000386387247","309869079396867762560934273077079548746","38084103606269357942233858568095345522","33549082759642156556829694966198608342","296278039906272251835155263313125576952","123519770131311333240296009758769010618","10995677455607459459260359557521367294"]}},{"source":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/catalog/CoverageStoreFileUploadTest.java"},"deprecated":false,"digest":{"line_hashes":["309082426858126745210650183439115166340","337361034561884298350907013984369937557","297555306000483314458677289185799031534","207765718480241857536744482334082175977","180959243290229562156925271101821567892","33645431657449214843451952930266866142","123125170087854378478761696600871365451","219190428602993442583198115084971440879","164053654295194152301370094059832537300","119837218509585155410036936744345310262","65663234372048241825274240893100316754","339076430051510287774542233218545823053","114542353126876902015714273126632776390","315097709803096193438640768470227661372","293742937782066362725299969568735293992","118116596754964937007541100351445974796","48743238537823372498977714457328973232","92524916327103454008028240252080456239","272868879292993357072175028411143143521"],"threshold":0.9},"id":"CVE-2024-23634-8945e011","signature_type":"Line","signature_version":"v1"},{"source":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/catalog/CoverageStoreFileUploadTest.java"},"deprecated":false,"digest":{"line_hashes":["309082426858126745210650183439115166340","337361034561884298350907013984369937557","297555306000483314458677289185799031534","207765718480241857536744482334082175977","180959243290229562156925271101821567892","33645431657449214843451952930266866142","123125170087854378478761696600871365451","57407527970140592538036992426043816526","72354321663219879367443667311937742404","97849720754555611478617553699283052789","65663234372048241825274240893100316754","339076430051510287774542233218545823053","114542353126876902015714273126632776390","315097709803096193438640768470227661372","293742937782066362725299969568735293992","118116596754964937007541100351445974796","48743238537823372498977714457328973232","92524916327103454008028240252080456239","272868879292993357072175028411143143521"],"threshold":0.9},"id":"CVE-2024-23634-8a0109db","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"line_hashes":["308000152145964687498887134462604613375","28739407125813735125245039605813116103","84138084668985175020862882281334817214","262292012105640346283534242848945238728","260510091157561342024840793854655014723","72262270920768769658983136620388815636","178832585856043923031350802348296971115","271832445070375282428735255476011451290","126227755279730869983626248972927300667","144676216191914581302609362348828138561","235328647097942847447992000425802903604","192022505370113240227675104113764071296","90100172719394872936967057832831039608","140536789106368110030557454719436228672","175054402451168235474539161800841163238","272258319508246045709618444968918531655","69451312942480148965927424592344173613","169558133343902617849012133725578202786","300326112085626459695796377456318049983","106552057095355301056622044481541892564","160451823126351064357671100871830113734","276303262881805777023545946712529757514","136061910124137567564213996105619411003","157789144441791475172264881216974533611","216656056156860216491413768753340243218","30584587213142902972153208626010345669","43693651672511506419582617180681485734"],"threshold":0.9},"id":"CVE-2024-23634-8c7c5796","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/catalog/DataStoreFileUploadTest.java"}},{"deprecated":false,"digest":{"line_hashes":["91323327798181873442456570359837643449","8084867114817336632967888909784128186","105776210922463476582948158944338495198","267754557678820502087173930467786281078","118514476757434660837207673169088769819","6445464632285287248710585882816899384","214669227369917810533352941002877196225","199443556526630585375961171272746196435","131939799065993605503560125497332645133","112923792290780782907095569625690882350"],"threshold":0.9},"id":"CVE-2024-23634-8e995513","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/CoverageStoreFileController.java"}},{"target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/CoverageStoreFileController.java"},"deprecated":false,"digest":{"line_hashes":["91323327798181873442456570359837643449","8084867114817336632967888909784128186","105776210922463476582948158944338495198","267754557678820502087173930467786281078","118514476757434660837207673169088769819","6445464632285287248710585882816899384","214669227369917810533352941002877196225","199443556526630585375961171272746196435","131939799065993605503560125497332645133","112923792290780782907095569625690882350"],"threshold":0.9},"id":"CVE-2024-23634-9ca23717","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772"},{"deprecated":false,"digest":{"function_hash":"154335872636005989907128810965162670284","length":469},"id":"CVE-2024-23634-b1815fa5","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/DataStoreFileController.java","function":"doFileUpload"}},{"source":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/DataStoreFileController.java"},"deprecated":false,"digest":{"line_hashes":["221363938807615370083651825189899870830","82074158454694567288269905986252079123","241651375631585082049028964955186733772","160367159401448115459126041543272621598","91323327798181873442456570359837643449","8084867114817336632967888909784128186","12925117755851544849053320092106896884","217772367612432232737912997595022062583","133972939248764268023344580745769109630","205520534646312423111458381080927178562","288351802723145432529847834005860691489","227470302920656822966447970376060741761","112923792290780782907095569625690882350"],"threshold":0.9},"id":"CVE-2024-23634-b7fdae6c","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"52519544737694042764404101977828132795","length":1926},"id":"CVE-2024-23634-bf3872d3","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a","target":{"function":"handleFileUpload","file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/AbstractStoreUploadController.java"}},{"deprecated":false,"digest":{"line_hashes":["308000152145964687498887134462604613375","28739407125813735125245039605813116103","84138084668985175020862882281334817214","262292012105640346283534242848945238728","260510091157561342024840793854655014723","72262270920768769658983136620388815636","178832585856043923031350802348296971115","271832445070375282428735255476011451290","126227755279730869983626248972927300667","144676216191914581302609362348828138561","235328647097942847447992000425802903604","192022505370113240227675104113764071296","90100172719394872936967057832831039608","140536789106368110030557454719436228672","175054402451168235474539161800841163238","272258319508246045709618444968918531655","69451312942480148965927424592344173613","169558133343902617849012133725578202786","300326112085626459695796377456318049983","106552057095355301056622044481541892564","160451823126351064357671100871830113734","276303262881805777023545946712529757514","136061910124137567564213996105619411003","157789144441791475172264881216974533611","216656056156860216491413768753340243218","30584587213142902972153208626010345669","43693651672511506419582617180681485734"],"threshold":0.9},"id":"CVE-2024-23634-d050a1d5","signature_type":"Line","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/catalog/DataStoreFileUploadTest.java"}},{"source":"https://github.com/geoserver/geoserver/commit/5d6af2f8ba9ad7dffae59575504a867159698772","target":{"file":"src/restconfig/src/main/java/org/geoserver/rest/catalog/DataStoreFileController.java"},"deprecated":false,"digest":{"line_hashes":["221363938807615370083651825189899870830","107438064365831083080784942896672562117","145900770807524564396713704981606538982","273983865376026374117167736095524035475","91323327798181873442456570359837643449","8084867114817336632967888909784128186","12925117755851544849053320092106896884","217772367612432232737912997595022062583","133972939248764268023344580745769109630","205520534646312423111458381080927178562","288351802723145432529847834005860691489","227470302920656822966447970376060741761","112923792290780782907095569625690882350"],"threshold":0.9},"id":"CVE-2024-23634-e45c6633","signature_type":"Line","signature_version":"v1"},{"deprecated":false,"digest":{"function_hash":"18932318375731399441328034578831121629","length":92},"id":"CVE-2024-23634-ef8b2e2d","signature_type":"Function","signature_version":"v1","source":"https://github.com/geoserver/geoserver/commit/c37f58fbacdfa0d581a6f99195585f70b1201f0a","target":{"file":"src/restconfig/src/test/java/org/geoserver/rest/catalog/DataStoreFileUploadTest.java","function":"removePdsDataStore"}}]}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:H"}]}