thomas-osgood/cve-2025-58360Python exploit class for CVE-2025-58360, an XXE vulnerability in GeoServer's GetMap function enabling arbitrary file read. Includes automated exploitation and data exfiltration.
The code and information contained within this repository is for educational and research purposes only. The owner of the repository takes no responsibility for anything you do with the code and/or information within this repository. Your actions are your own. Please use this legally and responsibly.
The Python3 class in the exploit/exploiter.py file (GeoDumper) automates the exploitation of the XXE vulnerability and saves the leaked information to a local file.
example:
import exploit.exploiter as exploiter
target_ip = "localhost"
secure = False
geoserver_path = "geoserver"
dumper = exploiter.GeoDumper(target_ip=target_ip, geoserver_path=geoserver_path, is_secure=secure)
(data, filename) = dumper.dump_file(target_file)
print(f"[+] data saved to \"{filename}\"")
print(f"[+] Data:\n{data.decode("utf-8")}")
The vulnerability in question exploits an improperly santized XML input to the GetMap function, leading to arbitrary file read by an attacker.
More information and better explinations/breakdowns of the vulnerability can be found in the links below.
note: I did not discover the vulnerability or do any research related to it. This code and repository was created while I did the associated romm on TryHackMe.