An unauthenticated file upload vulnerability in GeoNetwork core-geonetwork poses a high risk of unauthorized server file system manipulation.

This is a missing authorization vulnerability (CWE-862) occurring at the API endpoint for formatter creation. An unauthenticated attacker can bypass security checks to upload arbitrary .xsl or .zip files to the server.

The ability for an unauthenticated attacker to write arbitrary files to the server storage poses a significant threat to data integrity and system security. With a CVSS score of 8.6, this high-severity flaw could be leveraged to gain persistence, execute malicious code, or facilitate further compromise of the spatial resource catalog, leading to potential reputational damage and service disruption.

Immediate Action: Upgrade to GeoNetwork version 4.4.12 or 4.2.17 immediately to apply the vendor-supplied security patches.

Proactive Monitoring: Review web server and application access logs for suspicious POST requests targeting formatter creation endpoints or unexpected file upload activity.

Compensating Controls: Implement Web Application Firewall (WAF) rules to restrict access to the formatter API endpoints and block unauthorized file uploads containing restricted file extensions.

Public Exploit Available: Unknown

Given the ease of exploitation and the potential for unauthorized file system access, this vulnerability should be treated as a priority for all GeoNetwork deployments. Organizations must verify their current version and apply the recommended patches immediately to ensure the integrity of their catalog application.