GeoServer WMS GetMap XXE Arbitrary File Read

MetasploitMetasploit auxiliary PoCExploitRubyauxiliary_gather/geoserver_wms_getmap_xxe_file_read

PoC files

1 file

File viewing is interactive and short-lived. Downloads are password-protected ZIP archives using password eip.

Metasploit
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

Metasploit auxiliary module that exploits CVE-2025-58360, an unauthenticated XXE vulnerability in GeoServer WMS GetMap. It sends a crafted XML payload containing an external entity referencing a local file, then extracts the file content from the error response.

Backdoor review

No backdoor observed in reviewed code

The module is a straightforward Metasploit auxiliary module that exploits CVE-2025-58360, an XXE vulnerability in GeoServer. It sends a crafted XML payload to read a user-specified file and extracts the content from the error response. No backdoor, deceptive payload, or concealed operator-directed harm is present.

ClassificationExploit
Model confidence98%
AuthenticationNot required
Languagesruby
Target softwaregeoserver
Attack typesxxearbitrary file read
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The module actively sends a crafted XML payload to trigger an XXE vulnerability and reads arbitrary files from the target server, which constitutes exploitation, not just detection.

modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:55-64modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:89-98modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:108-116

Requirements

  • Target must be running a vulnerable GeoServer version (>= 2.26.0, <= 2.26.1 or <= 2.25.5) with the WMS endpoint accessible.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:17-23

Observed behavior

  • Constructs an XXE payload with a randomized entity name that references a local file via file:// URI.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:55-64
  • Sends a POST request to the GeoServer WMS endpoint with the XXE payload as XML body.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:89-98
  • Extracts the file content from the error message in the response using a regex on 'Unknown layer:'.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:81-87
  • Stores the exfiltrated file content as loot in the Metasploit database.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:123-130
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Read
datastore['FILEPATH']The module reads an arbitrary file path supplied by the operator via the FILEPATH option, which is the intended exploit behavior for CVE-2025-58360.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:50modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:97
Xxe Payload
XML with external entity referencing file://The module constructs an XXE payload that defines an external entity pointing to a local file, which is the core of the documented vulnerability exploitation.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:55-64
Loot Storage
store_loot('geoserver.file', ...)The retrieved file content is saved to the Metasploit loot database, which is standard behavior for auxiliary/gather modules.modules/auxiliary/gather/geoserver_wms_getmap_xxe_file_read.rb:123-130
Review boundaries

What the analysis did not establish

  • Only the module source code is provided; Metasploit framework mixins (e.g., HttpClient, Report) are not expanded, so exact HTTP request construction and response handling details are not fully visible.
  • The module's actual runtime behavior (e.g., success rate, error handling) cannot be verified from static source alone.
  • Only the module source is reviewed; Metasploit framework mixins (e.g., HttpClient, Report) and external payloads are not expanded, but the module itself does not invoke any external payloads or hidden behaviors.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

Linked vulnerabilities

1