Looking at today's weblogs from our honeypot, I noticed one IP in particular, 83.97.73.89, scanning for "/geoserver" related URLs. This isn't new, and we have seen researchers, in particular Shadowserver, looking for similar URLs at least since the beginning of the year.

(See our web logs for current data)

Geoserver is an open-source web application to organize geospatial data [1]. Looking for vulnerabilities, one looks, in particular, interesting: CVE-2022-24816. A writeup from December provides details, including exploit code [2].

Right now, I am just in the process of setting up a full Geoserver honeypot to see what else we may be getting (I will update this diary if I see anything). But my best guess is that this is yet another scan for vulnerable web apps. The same source IP scans for several other common vulnerabilities. We usually see between 15 and 17 URLs "hit" by this particular source IP address.

[1] https://geoserver.org/
[2] https://www.synacktiv.com/en/publications/exploiting-cve-2022-24816-a-code-injection-in-the-jt-jiffle-extension-of-geoserver.html

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS.edu
Twitter|