CriticalCVE-2022-24816

    Improper Control of Generation of Code in jai-ext (CVE-2022-24816)

    Published In CISA KEV since Sources: CVE.org, pwn.watch, OSV

    Share

    What is affected, what to do

    The vulnerability CVE-2022-24816 allows an attacker to perform Remote Code Execution (RCE) on systems using OSGeo GeoServer JAI-EXT, particularly when jt-jiffle accepts Jiffle scripts via network requests. This vulnerability is actively exploited in the wild, including in ransomware campaigns since 2024. It affects Maven dependencies it.geosolutions.jaiext.jiffle:jt-jiffle and it.geosolutions.jaiext.jiffle:jt-jiffle-language. A patch is available in version 1.2.22, which removes the ability to inject malicious code. Users should urgently upgrade to this version or, if unable to upgrade, remove janino-x.y.z.jar from the classpath to prevent Jiffle script compilation.

    The vulnerability is being actively exploited; treat it as a priority. Update Geosolutions-it Jai-ext to version 1.1.22. Immediate actions, mitigation and detection rules are in the runbook below.

    Affected
    • Geosolutions-it Jai-ext lt *..1.1.22
    Fixed in
    • Geosolutions-it Jai-ext 1.1.22

    Not sure whether and how you are affected? Ask a question about this vulnerability

    Metrics

    10.0

    Priority

    XIEM Effective CVSS: highest available CVSS rating from NVD and vendor data.

    Source: NVD, CVSS v3

    10.0

    CVSS v3

    Severity Critical on the scale from 0 to 10.

    Source: CVE.org, pwn.watch, OSV

    99.93 %

    EPSS score

    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.

    Source: FIRST EPSS, percentile 99.97

    Show all metrics
    Severity
    Critical
    Priority (0–325)

    The priority score is a consolidated metric that condenses several individual signals into a single, action-guiding ranking: technical severity (CVSS), exploitation likelihood (EPSS), known-exploited status (KEV) and the context of the affected asset. The aim is to answer the only truly important question in vulnerability management: what first?

    Read in glossary
    230.63 Methodology
    Exploit maturity

    An exploit is code or a technique that specifically uses a concrete vulnerability to force unintended behaviour — such as executing code or escalating privileges. It is the tool that turns a theoretical flaw into a practical attack.

    Read in glossary
    actively exploited
    XIEM Effective CVSS

    XIEM® is the tiered managed-security operating model from NEOSEC and a registered trademark of NEOSEC GmbH. It extends classic SIEM — the central collection, normalisation and correlation of security-relevant events — with endpoint forensics, network visibility and deception technology, and consolidates them into three building tiers: Sentry, Orchestrate and Command.

    Read in glossary
    10.0 Methodology
    CVSS v3

    CVSS is the globally established, open standard for assessing the technical severity of a vulnerability on a scale from 0 to 10. It describes how easily a flaw can be exploited and what damage it can cause — but not how likely its actual exploitation is. CVSS and the complementary EPSS deliberately answer different questions.

    Read in glossary
    10.0
    EPSS score

    The EPSS score is the absolute model output for an individual vulnerability: the estimated probability of real-world exploitation within the next 30 days, expressed as a value between 0 and 1 (i.e. 0 % to 100 %). A score of 0.42 means „the model estimates a 42 % chance of real-world exploitation within 30 days“.

    Read in glossary
    99.93 %
    High — model estimates ≥ 50% chance of real-world exploitation within 30 days.
    EPSS percentile

    The EPSS percentile is the relative position of a vulnerability within all EPSS-scored CVEs, expressed as a value between 0 and 1. A percentile of 0.90 means „this CVE has a higher EPSS score than 90 % of all other scored CVEs“. Unlike the EPSS score, it is not a probability — but a positioning within a ranking.

    Read in glossary
    99.97
    Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
    KEV status

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    Actively exploited
    Published
    In CISA KEV since

    The KEV catalogue is a list maintained by the US authority CISA of vulnerabilities for which active exploitation in the wild has been confirmed. It answers not the question „how severe?“ but „is it already being attacked?“ — thereby sharply prioritising patching.

    Read in glossary
    CISA assessment (SSVC)
    Exploitation: active · automatable · Technical impact: total
    Source: CISA Vulnrichment, as of 26 June 2024
    CWE

    CWE is a catalogue of typical weakness types in software and hardware — such as flawed input validation, unsafe memory handling or poor authentication. Where a CVE names a concrete vulnerability in a concrete product, a CWE describes the underlying class of defect.

    Read in glossary
    CWE-94

    Response and mitigation

    Why act now?

    Prioritisation rationale

    This CVE sits on KEV because GeoServer is a widely exposed component across public-sector, environmental and infrastructure operators, and the bug is a pre-authentication RCE triggered by a single HTTP POST — the vector AV:N/AC:L/PR:N/UI:N with scope change makes it one of the most reliable initial-access primitives in the GIS space. Exploitation likelihood is among the highest tracked by EPSS; working public PoCs have circulated since 2022 and are embedded in mass-scanning botnets that sweep for open GeoServer ports. For NIS2-regulated organisations running geospatial services (cadastre, environmental agencies, utilities with grid or network maps, water operators) this is a P1 even without the ransomware flag — observed attacker motivation is initial access and cryptomining, with lateral movement often following. No internet exposure and no JAI-EXT on the classpath drops it to P3 within the regular patch cycle.

    1. Runbook step 1

      Immediate response (0-24 h)

      • Upgrade JAI-EXT to 1.1.22 or later. In GeoServer deployments, replace the bundled jt-jiffle and jt-jiffle-language artifacts from Maven Central, then restart the servlet container (Tomcat/Jetty). Verify with jar tf WEB-INF/lib/jt-jiffle-*.jar that the old version is gone.
      • If an immediate upgrade is impossible: remove janino-*.jar and commons-compiler-*.jar from the GeoServer classpath (WEB-INF/lib/). Jiffle loses compile capability and the RCE chain breaks; raster-algebra via the WPS process ras:Jiffle will stop working — coordinate with the GIS team before cutting it.
      • For internet-reachable GeoServer instances, place a reverse proxy / WAF in front and restrict /geoserver/ows, /geoserver/wps and the WPS Request Builder page to authenticated sessions. Disable anonymous WPS execution in Services → WPS and bind it to an authenticated role.
      • Launch a compromise assessment: review process ancestry on the Tomcat/Jetty JVM for child processes (sh, bash, cmd.exe, powershell.exe, curl, wget, python) since the GeoServer went live. On any hit, isolate the host and rotate credentials, API keys and service accounts referenced from data_dir or environment variables.
      • Preserve the last 90 days of access logs (Tomcat localhost_access_log, reverse proxy) focusing on POSTs to /geoserver/wps and XML bodies containing jiffle or ras:Jiffle; archive them offline for forensic use.

    2. Runbook step 2

      Mitigation layers

      • Network segmentation: isolate GeoServer in its own VLAN with strict egress filtering. Allow outbound only to defined data sources (PostGIS, S3, internal tile caches). Block typical reverse-shell ports (4444, 1337) and force DNS egress through internal resolvers.
      • WAF rule: block POSTs to WPS endpoints whose body combines jt-jiffle, jiffle or ras:Jiffle with Runtime, ProcessBuilder, exec, java.lang. or Class.forName. Flag any WPS POST with Content-Length > 10 KB for review.
      • IAM / hardening: replace the default admin/geoserver credential with a strong password or SSO. Scope workspace permissions to authenticated users; constrain WPS execution to a dedicated ROLE_WPS role in the security subsystem.
      • Container hardening: run the GeoServer JVM as non-root inside a container with a read-only root filesystem, tmpfs for /tmp and --cap-drop=ALL. This blunts post-exploitation (droppers, cron persistence).
      • JVM telemetry: scrape JMX metrics (java.lang:type=OperatingSystem ProcessCpuLoad, Thread count). Sudden thread spawns correlated with WPS requests are a strong indicator of Janino compile activity.
      • SBOM scanning: run Dependency-Track or Trivy against every internally hosted Java webapp, not just GeoServer. jt-jiffle and janino can appear transitively in other GIS stacks (GeoNetwork, Java-backed geoprocessing components).

    3. Runbook step 3

      Detection rules

      • Reverse-proxy / access log: Suricata or Zeek rule on HTTP POST, URI match /geoserver/(wps|ows), payload contains jt-jiffle or ras:Jiffle. Sigma shape: selection: cs-uri-stem contains '/geoserver/wps' AND cs-method: 'POST' AND request_body contains 'jiffle'.
      • Sysmon EID 1 or Linux auditd execve: process ancestry java → sh/bash/python/curl/wget on the GeoServer host. KQL shape: DeviceProcessEvents | where InitiatingProcessFileName == "java" and FileName in ("sh","bash","curl","wget","nc","python3").
      • Sysmon EID 3 or Zeek conn.log: outbound connections from the Tomcat JVM PID to non-allowlisted IPs, especially TCP/4444, TCP/1337 or HTTP(S) to paste-and-fetch services (raw.githubusercontent.com, pastebin.com, transfer.sh).
      • Filesystem monitoring (auditd -w /tmp -p wa, Sysmon EID 11): creation of .class or .jar files in /tmp, /var/tmp or the GeoServer data_dir by the JVM outside normal startup windows.
      • GeoServer log (logs/geoserver.log): grep for org.codehaus.janino stack traces or JiffleIndirectRuntime compile errors. Repeated failures suggest exploit fuzzing — alert on more than 5 such entries per hour.

    Detection rules

    No NEOSEC detection rule is available for this vulnerability yet.

    Classification under NIS2 and CRA

    Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

    NIS2

    NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

    Read in glossary
    Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).
    CRA

    The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

    Read in glossary
    Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.
    ISO/IEC 27001

    ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

    Read in glossary
    Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

    Description

    JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.

    Source: NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), pwn.watch, OSV (Open Source Vulnerabilities), cvelistv5

    Affected products

    The following versions are affected. Older releases of the same product line are also vulnerable unless stated otherwise.

    Affected products
    Affected versionsFixed in
    geosolutions-itjai-ext
    • < 1.1.22
    • 1.1.22
    geosolutionsgroupjai-ext
    • < 1.1.22
    • 1.1.22
    mavenit.geosolutions.jaiext.jiffle:jt-jiffle
    • —
    • —
    mavenit.geosolutions.jaiext.jiffle:jt-jiffle-language
    • —
    • —

    Vendors and products

    Weakness classes (CWE)

    • CWE-94Improper Control of Generation of Code ('Code Injection')

      Base

      The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

      Entry at MITRE CWE-94

    Public exploit references

    Publicly reported proof-of-concepts, exploit modules and detection templates for this vulnerability. NEOSEC links to the original sources only and does not provide any exploit code.

    Public exploit references
    CISA KEV CatalogCISA Known Exploited Vulnerability (opens in a new tab)cisa.govactively exploited

    References & sources

    • github.comOSGeo advisory: CVE-2022-24816web, x_refsource_CONFIRM, Vendor advisory, pwn-watch
    • NVD (NIST)NVD: CVE-2022-24816advisory, pwn-watch
    • github.comgeosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fe…web, x_refsource_MISC, Patch
    • github.comgeosolutions-it/jai-extpackage
    • cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24816web, government-resource, US government resource
    • pwn.watchpwn.watch: OSGeo GeoServer JAI-EXT Code Injectionpwn-watch
    • github.comOSGeo advisory: CVE-2022-24816pwn-watch
    • cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch
    Embed badge

    Show the severity and KEV status of this vulnerability on your site – with a link back here. The image is updated hourly.

    Badge preview for CVE-2022-24816
    <a href="https://intel.neosec.eu/en/cve/CVE-2022-24816"><img src="https://intel.neosec.eu/badge/cve/CVE-2022-24816.svg?lang=en" alt="CVE-2022-24816 – NEOSEC Intel" height="20"></a>