rxerium/CVE-2025-58360

GitHubRepository PoCScanner

PoC files

3 files

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

GitHub
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

A Nuclei template that detects potentially vulnerable GeoServer instances by checking the Last-Modified header of a static resource and comparing it to a date threshold, without exploiting the XXE vulnerability.

Backdoor review

No backdoor observed in reviewed code

The repository contains a Nuclei detection template and a README for CVE-2025-58360. The template performs a benign GET request to fetch a logo image and checks the response status, body hash, and a header timestamp to identify potentially vulnerable GeoServer instances. No backdoor, deceptive payload, or concealed harmful behavior is present in the reviewed text.

ClassificationScanner
Model confidence95%
AuthenticationNot required
LanguagesYAML
Target softwareGeoServer
Attack typesdetection
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The artifact is a Nuclei template that performs passive detection based on HTTP headers and a date comparison. It does not send an XML payload, define external entities, or attempt to read local files, which would be required for an exploit. The README describes it as a 'detection script'.

CVE-2025-58360.yaml:1-48README.md:7

Requirements

  • Target must be running GeoServer and expose the /geoserver/web/ or /web/ path.CVE-2025-58360.yaml:20-21

Observed behavior

  • Sends an HTTP GET request to fetch a logo image from the target GeoServer instance.CVE-2025-58360.yaml:18-21
  • Extracts the Last-Modified header from the response.CVE-2025-58360.yaml:23-28
  • Converts the extracted date to a Unix timestamp.CVE-2025-58360.yaml:30-34
  • Matches if the response status is 200, the body matches a specific SHA-256 hash, and the timestamp is before November 28, 2025.CVE-2025-58360.yaml:36-48
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

Url
{{BaseURL}}/geoserver/web/wicket/resource/org.geoserver.web.GeoServerBasePage/img/logo.pngTarget path used in the Nuclei template to identify GeoServer instances.CVE-2025-58360.yaml:20
Url
{{BaseURL}}/web/wicket/resource/org.geoserver.web.GeoServerBasePage/img/logo.pngAlternative target path used in the Nuclei template.CVE-2025-58360.yaml:21
Hash
sha256:24738974cad3b3887d11c118248e625da82ca89c8fd21f5bc978d6a29888ebb6Expected SHA-256 hash of the logo image body used for GeoServer identification.CVE-2025-58360.yaml:44
Contact
Signal link: https://signal.me/#eu/0Qd68U1ivXNdWCF4hf70UYFo7tB0w-GQqFpYcyV6-yr4exn2SclB6bFeP7wTAxQwContact method provided in the README for questions about the script.README.md:44
Review boundaries

What the analysis did not establish

  • One file (LICENSE) was omitted from the evidence; its content is not material to the classification.
  • The evidence does not include the execution output of the template, so the detection logic is assessed solely from the static YAML definition.
  • One file (LICENSE) was omitted from the text evidence; its content is not reviewed.
  • Binary content is not present in the evidence.
  • The review is limited to the supplied text; no dynamic analysis or execution was performed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1