Read the docs
TI-2025-43683 Aliases GHSA-68cf-j696-wvv9

GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx

Priority LOW 38CWE-918Published · Updated

Key facts

Attack vector
—
Privileges required
—
User interaction
—
Attack complexity
—
Impact type
—
Confidentiality · integrity · availability
—
Fix status
Fixed

No CVSS vector from any source. Fix status from GitHub.

Summary

### Summary Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint. ### Mitigation To manage the proxy base value as a system administrator, use the parameter ``PROXY_BASE_URL`` to provide a non-empty value that cannot be overridden by the user interface or incoming request.[thomsmith](https://github.com/thomsmith). ### Resolution The TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript [Demo Requests](https://docs.geoserver.org/latest/en/user/configuration/demos/index.html#demo-requests) page to test OGC Web Services. ### References * [CVE-2024-29198](https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw) Unauthenticated SSRF via TestWfsPost

Why it matters now

Fix Fixed org.geoserver:gs-wfs (Maven): 2.24.4, 2.25.2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
—org.geoserver:gs-wfs (Maven)1.0.0 to before 2.24.42.24.4Patch availableGHSA-68cf-j696-wvv9
—org.geoserver:gs-wfs (Maven)2.25.0 to before 2.25.22.25.2Patch availableGHSA-68cf-j696-wvv9
  • org.geoserver:gs-wfs (Maven) Vendor— Affected 1.0.0 to before 2.24.4 Fixed in 2.24.4 Patch available GHSA-68cf-j696-wvv9
  • org.geoserver:gs-wfs (Maven) Vendor— Affected 2.25.0 to before 2.25.2 Fixed in 2.25.2 Patch available GHSA-68cf-j696-wvv9

Remediation

  • Fix · GHSA-68cf-j696-wvv9 org.geoserver:gs-wfs (Maven) Fixed in 2.24.4 Advisory →
  • Fix · GHSA-68cf-j696-wvv9 org.geoserver:gs-wfs (Maven) Fixed in 2.25.2 Advisory →

Timeline

  1. 2026-10-03 Threatist record created from GHSA-68cf-j696-wvv9

References

Other 3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences