Listen to this Post
The vulnerability exploits the GeoServer WMS GetMap endpoint at /geoserver/wms, which accepts XML input without proper sanitization. When an XML request is processed, the server’s parser resolves external entity references defined within the DOCTYPE declaration. An attacker can craft a malicious XML payload that includes an external entity pointing to local files or network resources. For example, by defining an entity like &xxe; with SYSTEM “file:///etc/passwd”, the server reads and returns sensitive file contents during parsing. This occurs due to insufficient configuration of the XML parser, which fails to disable external entity resolution. The attack leverages the application’s trust in XML input, allowing data exfiltration from the server’s filesystem. Affected versions include GeoServer 2.26.0 to 2.26.1 and 2.25.5 and below, where the vulnerable code path handles GetMap operations. The CVSS score of 8.2 reflects high severity due to the network-based attack vector, low attack complexity, and high impact on confidentiality with low impact on availability.
Platform: GeoServer
Version: Before 2.25.6 2.26.2
Vulnerability: XML External Entity
Severity: High
Date: Unknown
Prediction: Patched in updates
What Undercode Say:
Analytics:
Showing bash commands and codes related to the blog
curl -X POST http://target/geoserver/wms -H “Content-Type: application/xml” -d ‘]>
python3 -c “import requests; xml = ”’]>
How Exploit:
Craft XML request with external entities to read local files or perform SSRF attacks via the GetMap endpoint.
Protection from this CVE:
Update to GeoServer 2.25.6, 2.26.3, or 2.27.0; disable external entity resolution in XML parsers.
Impact:
Information disclosure, denial of service, potential remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: www.cve.org
Extra Source Hub:
Undercode
