CVE-2024-29198

HIGHNuclei

GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2024-29198 has a selected CVSS score of 7.5 (high); EIP currently links 1 Nuclei template.

Description

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Jul 31, 2025 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 10, 2025 · Source: CVE List

Affected products and versions

4
ProductSourceVersion range

GeoServer

Browse OSGeo / GeoServer
VulnCheckVersion data not supplied

geoserver

Browse geoserver / geoserver
CVE List>= 2.0.0, < 2.24.4affected
>= 2.25.0, < 2.25.2affected

org.geoserver.web:gs-app

Browse Maven / org.geoserver.web:gs-app
GitHub Advisory2.0.0 to < 2.24.4 · Fixed in 2.24.4affected
2.25.0 to < 2.25.2 · Fixed in 2.25.2affected

org.geoserver:gs-wfs

Browse Maven / org.geoserver:gs-wfs
GitHub Advisory2.0.0 to < 2.24.4 · Fixed in 2.24.4affected
2.25.0 to < 2.25.2 · Fixed in 2.25.2affected

Nuclei templates

1
ProjectDiscoveryHIGHGeoServer Demo Request Endpoint - Server Side Request ForgeryCVSS 7.5

It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.

Impact

An attacker can exploit this vulnerability to access internal resources, enumerate internal networks, and potentially access sensitive data in cloud environments through the server-side request forgery attack.

Remediation

Upgrade to a patched version of GeoServer or configure the Proxy Base URL properly to prevent unauthorized server-side requests through the TestWfsPost endpoint.

WeaknessesCWE-918
Authorsiamnoooob, pdresearch
Template tagscvecve2024ssrfgeoserveroosoastvkevvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Shodan: http.title:"geoserver"
Shodan: server:"geohttpserver"
FOFA: app="geoserver"
FOFA: title="geoserver"
Google: intitle:"geoserver"
https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw https://osgeo-org.atlassian.net/browse/GEOS-11390 https://osgeo-org.atlassian.net/browse/GEOS-11794 https://nvd.nist.gov/vuln/detail/CVE-2024-29198

Source: ProjectDiscovery

References

6