GitHub Advisoryadvisory · Maven

GHSA-r4hf-r8gj-jgw2 Coverage REST API Server Side Request Forgery

MEDIUM Published 2025-06-10 Modified 2025-06-10 Official page ↗
Aliases
CVE-2024-40625
Ecosystem
Maven
Packages
org.geoserver:gs-rest, org.geoserver.web:gs-web-app
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:L
Weaknesses
CWE-918
Reviewed
2025-06-10

Affected packages

• Maven org.geoserver:gs-rest: < 2.26.0 → fixed in 2.26.0 • Maven org.geoserver.web:gs-web-app: < 2.26.0 → fixed in 2.26.0

Description

Summary The Coverage rest api `/workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format}` allow to upload file with a specified url (with {method} equals 'url') with no restrict. Details The Coverage rest api `/workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format}` allow to upload file with a specified url (with {method} equals 'url'). But this url has not been check with URL Checks feature. For example, should add the code below to check fileURL: ```java URLCheckers.confirm(fileURL) ``` The vulnerable code was RESTUtils.java Impact This vulnerability presents the opportunity for Server Side Request Forgery. References • https://osgeo-org.atlassian.net/browse/GEOS-11468 • https://osgeo-org.atlassian.net/browse/GEOS-11717

Related

Alias · CVE (1)

  • CVE-2024-40625 GeoServer is an open source server that allows users to share and edit geospatial data. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References