GHSA-68cf-j696-wvv9 GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx
Unauthenticated attackers can exploit Server-Side Request Forgery in GeoServer's TestWfsPost endpoint to access internal resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is GHSA-68cf-j696-wvv9?
GHSA-68cf-j696-wvv9 is a server-side request forgery vulnerability in org.geoserver:gs-wfs, published on 10 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Summary
Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint.
Mitigation
To manage the proxy base value as a system administrator, use the parameter PROXY_BASE_URL to provide a non-empty value that cannot be overridden by the user interface or incoming request.thomsmith.
Resolution
The TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript Demo Requests page to test OGC Web Services.
References
- CVE-2024-29198 Unauthenticated SSRF via TestWfsPost
Which versions are affected by GHSA-68cf-j696-wvv9?
4 open source packages ship an affected version, including org.geoserver:gs-wfs.
| Package | Affected | Fixed in |
|---|---|---|
org.geoserver:gs-wfs Maven | From 1.0.0 | 2.24.4 |
org.geoserver:gs-wfs Maven | From 1.0.0 | 2.24.4 |
org.geoserver:gs-wfs Maven | From 2.25.0 | 2.25.2 |
org.geoserver:gs-wfs Maven | From 2.25.0 | 2.25.2 |
How do I fix GHSA-68cf-j696-wvv9?
Upgrade org.geoserver:gs-wfs to a fixed version for your release line: 2.24.4 or 2.25.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is GHSA-68cf-j696-wvv9 being exploited?
There is no known exploitation of GHSA-68cf-j696-wvv9 in the wild and no public exploit code.