GeoServer Demo Request Endpoint - Server Side Request Forgery
It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data. References: https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw https://osgeo-org.atlassian.net/browse/GEOS-11390 https://osgeo-org.atlassian.net/browse/GEOS-11794 https://nvd.nist.gov/vuln/detail/CVE-2024-29198 Remediation: Upgrade to a patched version of GeoServer or configure the Proxy Base URL properly to prevent unauthorized server-side requests through the TestWfsPost endpoint.
10 assets checked · domain, subdomain, ipv4