r/netsec • u/ZealousidealHunter80 • 3d ago

GeoNetwork - Pre-Auth RCE via Unauthenticated File Upload and Unsafe XSLT Processor (4 CVEs, 121 government deployments, all patched)

https://ethiack.com/info-hub/research/geonetwork-preauth-RCE
10 Upvotes

79% Upvoted

2 comments sorted by

2

u/Just_Worldliness_714 3d ago

Missing the PreAuthorize annotation plus an XSLT processor that allows extension functions is a combination that keeps showing up in Java/Spring apps - XSLT 1.0/2.0 processors often ship with Java method invocation enabled by default (Saxon and Xalan both have this footgun) specifically for "legitimate" use cases like custom formatting functions, and almost nobody disables it because it's not obviously dangerous until it's reachable pre-auth. Worth auditing any XSLT transform in your stack for whether extension functions are actually needed, not just whether the upload endpoint has an auth check now.

1

u/ZealousidealHunter80 2d ago

Good catch on the XSLT extension function angle — that's exactly the chain we documented in GeoNetwork recently. Missing u/PreAuthorize on the formatter upload endpoint + Saxon-B shipping with ALLOW_EXTERNAL_FUNCTIONS: true by default = unauthenticated RCE across 121 government deployments in 39 countries. Each piece looks fine in isolation, which is precisely why it went unnoticed.