diff --git a/advisories/github-reviewed/2025/06/GHSA-5gw5-jccf-6hxw/GHSA-5gw5-jccf-6hxw.json b/advisories/github-reviewed/2025/06/GHSA-5gw5-jccf-6hxw/GHSA-5gw5-jccf-6hxw.json new file mode 100644 index 00000000000..a18a57e9b28 --- /dev/null +++ b/advisories/github-reviewed/2025/06/GHSA-5gw5-jccf-6hxw/GHSA-5gw5-jccf-6hxw.json @@ -0,0 +1,126 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-5gw5-jccf-6hxw", + "modified": "2025-06-10T14:13:25Z", + "published": "2025-06-10T14:13:25Z", + "aliases": [ + "CVE-2024-29198" + ], + "summary": "GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost", + "details": "### Summary\n\nIt possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set.\n\n### Details\n\nA unauthenticated user can supply a request that will be issued by the server. This can be used to enumerate internal networks and also in the case of cloud instances can be used to obtain sensitive data.\n\n### Mitigation\n\n1. When using GeoServer with a proxy, manage the proxy base value as a system administrator, use the application property ``PROXY_BASE_URL`` to provide a non-empty value that cannot be overridden by the user interface or incoming request.\n\n2. When using GeoServer directly without a proxy, block all access to TestWfsPost by editing the web.xml file. Adding this block right before the end:\n\n ```xml\n \n \n BlockDemoRequests\n /TestWfsPost/*\n \n \n BLOCKED\n \n \n ```\n\n### Resolution\n\nUpgrading to GeoServer 2.24.4, or 2.25.2, removes the ``TestWfsPost`` servlet resolving this issue.\n\nThe demo request page functionality is now implemented directly in the browser.\n\n### Reference\n\n- https://osgeo-org.atlassian.net/browse/GEOS-11794\n- https://osgeo-org.atlassian.net/browse/GEOS-11390\n- https://nvd.nist.gov/vuln/detail/CVE-2021-40822", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.geoserver:gs-wfs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.24.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geoserver.web:gs-app" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.0.0" + }, + { + "fixed": "2.24.4" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geoserver:gs-wfs" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.25.0" + }, + { + "fixed": "2.25.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geoserver.web:gs-app" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.25.0" + }, + { + "fixed": "2.25.2" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw" + }, + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-40822" + }, + { + "type": "PACKAGE", + "url": "https://github.com/geoserver/geoserver" + }, + { + "type": "WEB", + "url": "https://osgeo-org.atlassian.net/browse/GEOS-11390" + }, + { + "type": "WEB", + "url": "https://osgeo-org.atlassian.net/browse/GEOS-11794" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-918" + ], + "severity": "HIGH", + "github_reviewed": true, + "github_reviewed_at": "2025-06-10T14:13:25Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/06/GHSA-jm79-7xhw-6f6f/GHSA-jm79-7xhw-6f6f.json b/advisories/github-reviewed/2025/06/GHSA-jm79-7xhw-6f6f/GHSA-jm79-7xhw-6f6f.json new file mode 100644 index 00000000000..49ab8dd784a --- /dev/null +++ b/advisories/github-reviewed/2025/06/GHSA-jm79-7xhw-6f6f/GHSA-jm79-7xhw-6f6f.json @@ -0,0 +1,130 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-jm79-7xhw-6f6f", + "modified": "2025-06-10T14:14:08Z", + "published": "2025-06-10T14:14:08Z", + "aliases": [ + "CVE-2024-38524" + ], + "summary": "GWC Home Page communicate version and revision information", + "details": "### Summary\nThe GeoWebCache home page includes version and revision information about the software in use. This information is sensitive from a security point of view because it allows software used by the server to be easily identified.\n\n### Details\norg.geowebcache.GeoWebCacheDispatcher.handleFrontPage(HttpServletRequest, HttpServletResponse) has no check to hide potentially sensitive information from users except for a hidden system property to hide the storage locations that defaults to showing the locations.\n\n### PoC\nJust open http://localhost:8080/geoserver/gwc/\n\n### Impact\nIn addition to exposing the version and revision information, the home page will expose the config file and storage locations which may expose the system's temp directory location and whether or not GeoServer is running in a Windows operating system. The approximate server start time and some basic GWC usage information is also exposed.\n\n### References\nhttps://osgeo-org.atlassian.net/browse/GEOS-11677\nhttps://github.com/geoserver/geoserver/pull/8189\nhttps://github.com/GeoWebCache/geowebcache/issues/1344\nhttps://github.com/GeoWebCache/geowebcache/pull/1345", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.geoserver.web:gs-web-app" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.26.0" + }, + { + "fixed": "2.26.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geoserver.web:gs-web-app" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.25.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geoserver:gs-gwc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.26.0" + }, + { + "fixed": "2.26.2" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geoserver:gs-gwc" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.25.6" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-jm79-7xhw-6f6f" + }, + { + "type": "WEB", + "url": "https://github.com/GeoWebCache/geowebcache/issues/1344" + }, + { + "type": "WEB", + "url": "https://github.com/GeoWebCache/geowebcache/pull/1345" + }, + { + "type": "WEB", + "url": "https://github.com/geoserver/geoserver/pull/8189" + }, + { + "type": "PACKAGE", + "url": "https://github.com/geoserver/geoserver" + }, + { + "type": "WEB", + "url": "https://osgeo-org.atlassian.net/browse/GEOS-11677" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-200" + ], + "severity": "MODERATE", + "github_reviewed": true, + "github_reviewed_at": "2025-06-10T14:14:08Z", + "nvd_published_at": null + } +} \ No newline at end of file diff --git a/advisories/github-reviewed/2025/06/GHSA-mc43-4fqr-c965/GHSA-mc43-4fqr-c965.json b/advisories/github-reviewed/2025/06/GHSA-mc43-4fqr-c965/GHSA-mc43-4fqr-c965.json new file mode 100644 index 00000000000..4bf99565363 --- /dev/null +++ b/advisories/github-reviewed/2025/06/GHSA-mc43-4fqr-c965/GHSA-mc43-4fqr-c965.json @@ -0,0 +1,83 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-mc43-4fqr-c965", + "modified": "2025-06-10T14:13:44Z", + "published": "2025-06-10T14:13:44Z", + "aliases": [ + "CVE-2024-34711" + ], + "summary": "GeoServer has improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF)", + "details": "### Summary\nAn improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP server. Attacker can abuse this to scan internal networks and gain information about them then exploit further. Moreover, attacker can read limited `.xsd` file on system.\n\n### Details\nBy default, GeoServer use `PreventLocalEntityResolver` class from GeoTools to filter out malicious URIs in XML entities before resolving them. The URI must match the regex `(?i)(jar:file|http|vfs)[^?#;]*\\\\.xsd`. But the regex leaves a chance for attackers to request to any HTTP server or limited file.\n\n### Impact\n\nAn unauthenticated attacker can:\n1. Scan internal network to gain insight about it and exploit further.\n2. SSRF to endpoint ends with `.xsd`.\n3. Read limited `.xsd` file on system.\n\n### Mitigation\n\n1. Define the system property ``ENTITY_RESOLUTION_ALLOWLIST`` to limit the supported external schema locaitons.\n2. The built-in allow list covers the locations required for the operation of OGC web services: ``www.w3.org``,``schemas.opengis.net``,``www.opengis.net``,``inspire.ec.europa.eu/schemas``.\n3. The [user guide](https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities) provides details on how to add additional locations (this is required for app-schema plugin where a schema is supplied to define an output format).\n\n### Resolution \n\n1. GeoServer 2.25.0 and greater default to the use of ``ENTITY_RESOLUTION_ALLOWLIST`` and does not require you to provide a system property.\n2. The use of ``ENTITY_RESOLUTION_ALLOWLIST`` is still supported if you require additional schema locations to be supported beyond the built-in allow list.\n3. GeoServer 2.25.1 change ``ENTITY_RESOLUTION_ALLOWLIST `` no longer supports regular expressions\n\n### References\n\n* [External Entities Resolution](https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities) (GeoServer User Guide)\n\n### Credits\n* Le Mau Anh Phong from VNG Security Response Center & VNUHCM - University of Information Technology", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Maven", + "name": "org.geoserver.web:gs-web-app" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.25.0" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Maven", + "name": "org.geoserver.main:gs-main" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.25.0" + } + ] + } + ] + } + ], + "references": [ + { + "type": "WEB", + "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-mc43-4fqr-c965" + }, + { + "type": "WEB", + "url": "https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities" + }, + { + "type": "PACKAGE", + "url": "https://github.com/geoserver/geoserver" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-20", + "CWE-200", + "CWE-611", + "CWE-918" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2025-06-10T14:13:44Z", + "nvd_published_at": null + } +} \ No newline at end of file