The API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled files.
An unauthenticated attacker can upload arbitrary .xsl or .zip formatter files to the server.
An unauthenticated attacker can write arbitrary files into the GeoNetwork formatter directory. On its own this constitutes unauthorized write access to server storage.
Until a patched release is deployed, block POST requests to the endpoint at the reverse proxy layer.
Apache httpd (mod_authz_core):
Note: these rules block the endpoint entirely for write methods. Authenticated administrators will also be unable to upload formatters via the API until the application is patched. The formatter management UI in the admin console uses this same endpoint.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
