CVE-2022-24816

Deeper analysis

CVE-2022-24816 is a remote code execution vulnerability in the JAI-EXT library, an open-source extension to the Java Advanced Imaging API. It arises when applications accept Jiffle scripts over the network and compile them into Java bytecode using the Janino library; the lack of input sanitization permits arbitrary code injection. The flaw directly affects downstream projects such as GeoServer that expose this functionality.

An unauthenticated attacker can supply a malicious Jiffle script via a network request, causing the application to compile and execute attacker-controlled Java code. Successful exploitation yields full confidentiality, integrity Availability impact and crosses trust boundaries, consistent with the CVSS 10.0 rating and CWE-94 classification.

The project’s security advisory and patch release (version 1.2.22) disable the ability to inject executable code into compiled scripts. Administrators who cannot upgrade are advised to remove the janino JAR from the runtime classpath, thereby preventing Jiffle compilation entirely. The vulnerability is catalogued in CISA’s Known Exploited Vulnerabilities list, and its EPSS score has remained consistently high (current 0.94, peak 0.97), indicating sustained exploitation interest after disclosure.