Nuclei Template
View the template here CVE-2022-24816.yaml
Validate with Nuclei
echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-24816.yaml
Programs run on GeoServer before 1.2.2 which use jt-jiffle and allow Jiffle script to be provided via network request are susceptible to remote code execution. The Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects downstream GeoServer 1.1.22.
View the template here CVE-2022-24816.yaml
echo "$URL" | nuclei -t ~/nuclei-templates/http/cves/2022/CVE-2022-24816.yaml
References:
https://www.synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver.html