CVE-2022-24816 JAI-EXT
| Affected software | JAI-EXT |
|---|---|
| Severity | 10.0 Critical CVSS 3.1 3 scores |
| Fixed in | 1.1.22 |
| Weakness | Code injection (CWE-94) |
| Published | 13 Apr 2022 |
| Updated | 29 Sep 2026 |
Description
JAI-EXT is an open-source project which aims to extend the Java Advanced Imaging (JAI) API. Programs allowing Jiffle script to be provided via network request can lead to a Remote Code Execution as the Jiffle script is compiled into Java code via Janino, and executed. In particular, this affects the downstream GeoServer project. Version 1.2.22 will contain a patch that disables the ability to inject malicious code into the resulting script. Users unable to upgrade may negate the ability to compile Jiffle scripts from the final application, by removing janino-x.y.z.jar from the classpath.
Exploitation status
Exploited
Confirmed real-world exploitation.
Exploitation status
- CISA KEV listed Confirmed exploitation in the wild. Added 2024-06-26 · remediation due 2024-07-17 · ransomware use: unknown
- VulnCheck KEV listed Exploitation reported in the wild. 3 citations · honeypot sightings · 1 exploit · earliest 2024-01-22.
- CISA Vulnrichment exploitation: active CISA records active exploitation. Automatable: yes, technical impact: total.
- Indexed PoC 2 indexed Published artifacts you can open, in GitHub PoC, Nuclei; first seen 2025-01-17.
- EPSS 99.9% chance in 30 days A model's forecast, not a report of exploitation. Higher than 99.9% of all scored CVEs.
VulnCheck KEV
Exploitation evidence from VulnCheck Known Exploited Vulnerabilities (VulnCheck KEV), used under VulnCheck's community terms. View CVE-2022-24816 in VulnCheck (free account).
| Evidence | Source | Detail | Date |
|---|---|---|---|
| Honeypot sighting | Shadowserver honeypots | Exploitation attempts seen on 839 days | 2024-01-22 to 2026-11-12 |
| Reported exploitation | cisa.gov | /sites/default/files/feeds/known_exploited_vulnerabilities.json | 2024-06-26 |
| Reported exploitation | info.greynoise.io | /hubfs/resources/GreyNoise-2025-Mass-Internet-Exploitation-Report.pdf | 2025-02-27 |
| Reported exploitation | app.crowdsec.net | /cti/cve-explorer/CVE-2022-24816 | 2025-06-07 |
| Exploit reference | VulnCheck XDB 8c423c9c5367 | Exploit type: initial-access | 2025-01-17 |
| Index | Artifact | Stars | First seen |
|---|---|---|---|
| GitHub PoC | c1ph3rbyt3/CVE-2022-24816 | 1 | 2025-01-17 |
| Nuclei | GeoServer <1.2.2 - Remote Code Execution |
Waratek protection
Waratek has a rule that blocks attacks on this vulnerability.
- Protection full Process
- Action available security rule
- Review human Researcher
- Record active
| Decided by | A researcher's recorded decision for this specific CVE |
|---|---|
| Finding | A researcher found this CVE protected by the ARMR Process rule. |
Waratek research note
written 2026-11-13Written by a Waratek engineer who reviewed this CVE. Their decision sets the status above, ahead of every automated rule except a withdrawal.
Comments
Rule Name: ARMR Process rule
Jiffle script code injection in GeoServer WPS ras:Jiffle, compiled by Janino; the Process rule (with /bin/* and /usr/* listed, or C:\Windows\System32* on Windows) blocks the injected class's Runtime.exec that every public exploit runs. Injected code that reads files or data directly in Java, or loads a hidden webshell, without starting a program, is not stopped.
How to mitigate CVE-2022-24816
Upgrade JAI-EXT to 1.1.22 or later. Until you can, Waratek RASP blocks exploitation with its process rule. It runs inside the Java application, with no code changes.
Waratek RASP Runtime protection for Java applications
CVSS
10.0 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
3 metrics
CVSS
10.0 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
3 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 10.0 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
security-advisories@github.com | Secondary | published |
| CVSS 3.1 | 10.0 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
NVD | Primary | |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
it.geosolutions.jaiext.jiffle:jt-jiffle |
0 | 1.1.22 |
unbounded |
it.geosolutions.jaiext.jiffle:jt-jiffle-language |
0 | 1.1.22 |
unbounded |
Products and versions
3 products, 3 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | geosolutionsgroup | jai-ext | generic | ＜ 1.1.22 |
| osv | it.geosolutions.jaiext.jiffle | jt-jiffle | generic | ＜ 1.1.22 |
| osv | it.geosolutions.jaiext.jiffle | jt-jiffle-language | generic | ＜ 1.1.22 |
References
Timeline
Timeline
| Published | 2022-04-13 | By the CVE Program. |
|---|---|---|
| VulnCheck KEV: earliest evidence | 2024-01-22 | Date of the oldest evidence of exploitation in VulnCheck KEV's record. VulnCheck does not publish the date it listed the CVE. |
| Added to CISA KEV | 2024-06-26 | Listed in CISA's Known Exploited Vulnerabilities catalog. |
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |
| Last VRT activity | 2026-09-29 | Most recent commit touching this CVE's classification, patch or rule file. |
| VulnCheck KEV: latest evidence | 2026-11-12 | Date of the newest report, exploit reference or honeypot sighting in VulnCheck KEV's record. |
| Classification created | 2026-11-13 | First commit adding this CVE's research note. |