{"id":"CVE-2022-24816","published":"2022-04-13T21:15:07Z","modified":"2026-06-17T04:32:35Z","title":"OSGeo GeoServer JAI-EXT Code Injection Vulnerability","vendor":"OSGeo","product":"JAI-EXT","tier":"core","eol":null,"description":{"text":"JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw is a code injection weakness in the JAI-EXT project, an open-source extension to the Java Advanced Imaging API, where Jiffle scripts supplied through network requests are compiled into Java via Janino and executed, with the downstream GeoServer project affected. An attacker who can submit a Jiffle script over the network, without needing authentication or any user interaction, can inject malicious code that is compiled and run, achieving remote code execution, provided the application accepts such scripts from network requests.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:39Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.99929,"percentile":0.99969,"date":"2026-10-29","provenance":"source"},"kev":{"dateAdded":"2024-06-26","dueDate":"2024-07-17","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"This vulnerability affects a common open-source component, third-party library, or a protocol used by different products. The patched JAI-EXT is version 1.1.22: https://github.com/geosolutions-it/jai-ext/releases/tag/1.1.22, https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx;  https://nvd.nist.gov/vuln/detail/CVE-2022-24816","provenance":"source"},"vulncheckKev":{"dateAdded":"2024-01-22","exploitedFirstSeen":"2024-01-22","ransomware":false,"evidence":[{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2022-24816","date":"2024-01-22"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-23&host_type=src&vulnerability=cve-2022-24816","date":"2024-01-23"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-24&host_type=src&vulnerability=cve-2022-24816","date":"2024-01-24"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-25&host_type=src&vulnerability=cve-2022-24816","date":"2024-01-25"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-26&host_type=src&vulnerability=cve-2022-24816","date":"2024-01-26"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-27&host_type=src&vulnerability=cve-2022-24816","date":"2024-01-27"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-28&host_type=src&vulnerability=cve-2022-24816","date":"2024-01-28"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-29&host_type=src&vulnerability=cve-2022-24816","date":"2024-01-29"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-30&host_type=src&vulnerability=cve-2022-24816","date":"2024-01-30"},{"url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-31&host_type=src&vulnerability=cve-2022-24816","date":"2024-01-31"}],"evidenceTotal":829,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-94","name":"Improper Control of Generation of Code"}],"references":[{"url":"https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb","tags":["Patch"]},{"url":"https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx","tags":["Vendor Advisory"]},{"url":"https://github.com/geosolutions-it/jai-ext/commit/cb1d6565d38954676b0a366da4f965fef38da1cb","tags":["Patch"]},{"url":"https://github.com/geosolutions-it/jai-ext/security/advisories/GHSA-v92f-jx6p-73rx","tags":["Vendor Advisory"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-24816","tags":["US Government Resource"]}],"techniques":[{"id":"T1190","name":"Exploit Public-Facing Application","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Network-facing input enables remote exploitation of application","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution","start":92,"end":194}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Injected script executes arbitrary code on host","mappingType":"primary_impact","evidence":[{"from":"description","quote":"the Jiffle script is compiled into Java code via Janino, and executed","start":198,"end":267}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[{"ecosystem":"Maven","package":"it.geosolutions.jaiext.jiffle:jt-jiffle","vulnerableRanges":["<1.1.22"],"patched":["1.1.22"],"from":["GHSA-v92f-jx6p-73rx"],"provenance":"source"},{"ecosystem":"Maven","package":"it.geosolutions.jaiext.jiffle:jt-jiffle-language","vulnerableRanges":["<1.1.22"],"patched":["1.1.22"],"from":["GHSA-v92f-jx6p-73rx"],"provenance":"source"}],"advisories":[{"id":"GHSA-v92f-jx6p-73rx","url":"https://github.com/advisories/GHSA-v92f-jx6p-73rx","severity":"CRITICAL","ecosystem":"Maven","package":"it.geosolutions.jaiext.jiffle:jt-jiffle","vulnerableRanges":["<1.1.22"],"patched":["1.1.22"],"provenance":"source","from":"GHSA"},{"id":"GHSA-v92f-jx6p-73rx","url":"https://github.com/advisories/GHSA-v92f-jx6p-73rx","severity":"CRITICAL","ecosystem":"Maven","package":"it.geosolutions.jaiext.jiffle:jt-jiffle-language","vulnerableRanges":["<1.1.22"],"patched":["1.1.22"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2023-2600","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2600","exploited":true,"exploitedSince":"2024-06-26","provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":1,"skipped":0,"earliest":"2025-01-17","earliestUrl":"https://github.com/c1ph3rbyt3/CVE-2022-24816","repos":[{"name":"c1ph3rbyt3/CVE-2022-24816","url":"https://github.com/c1ph3rbyt3/CVE-2022-24816","stars":1,"created":"2025-01-17"}]},"nuclei":[{"id":"CVE-2022-24816","name":"GeoServer <1.2.2 - Remote Code Execution","severity":"critical","path":"http/cves/2022/CVE-2022-24816.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2022/CVE-2022-24816.yaml"}],"first":{"date":"2025-01-17","source":"PoC-in-GitHub","url":"https://github.com/c1ph3rbyt3/CVE-2022-24816"},"provenance":"source"},"exploitRefs":[],"flow":[{"stage":"exploitation","techniques":["T1190"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2022-04-13","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-24816","provenance":"source"},{"date":"2024-01-22","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://dashboard.shadowserver.org/statistics/honeypot/vulnerability/map/?day=2024-01-22&host_type=src&vulnerability=cve-2022-24816","provenance":"source"},{"date":"2024-06-26","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2024-06-26","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2023-2600","provenance":"source"},{"date":"2025-01-17","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/c1ph3rbyt3/CVE-2022-24816","provenance":"source"}],"speed":{"daysToPublicExploit":1010,"firstExploitFrom":"PoC-in-GitHub","daysToKev":805},"priority":{"score":70.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 1012 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.99,"detail":"percentile 0.9997"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 PoC-in-GitHub repo; 1 nuclei template"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}