GitHub Advisoryadvisory · Maven

GHSA-68cf-j696-wvv9 GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx

HIGH Published 2025-06-10 Modified 2025-06-10 Official page ↗
Ecosystem
Maven
Packages
org.geoserver:gs-wfs
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2025-06-10

Affected packages

• Maven org.geoserver:gs-wfs: >= 1.0.0, < 2.24.4 → fixed in 2.24.4 • Maven org.geoserver:gs-wfs: >= 2.25.0, < 2.25.2 → fixed in 2.25.2

Description

Summary Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint. Mitigation To manage the proxy base value as a system administrator, use the parameter ``PROXY_BASE_URL`` to provide a non-empty value that cannot be overridden by the user interface or incoming request.thomsmith. Resolution The TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript Demo Requests page to test OGC Web Services. References • CVE-2024-29198 Unauthenticated SSRF via TestWfsPost

Related

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References