CVE-2025-52465: GeoServer Master Password Plaintext Dump Vulnerability

Technical summary

CVE-2025-52465 exploits insufficient input validation in GeoServer's Master Password Dump web interface. The vulnerability exists in versions prior to 2.26.4 and 2.27.3. An authenticated administrator can supply an arbitrary absolute file path to the Master Password Dump page, causing GeoServer to write the plaintext master password to that location. The attack requires: (1) authenticated admin access, (2) a non-existent target file, and (3) all parent directories already present. Installations with the web interface disabled or removed are unaffected. The issue is categorized under CWE-73 (External Control of File Name or Path).

Business impact

Compromise of the master password undermines GeoServer's entire security posture. An administrator who exfiltrates the master password can reset user credentials, modify security policies, access restricted geospatial datasets, or establish persistent backdoor access. For organizations relying on GeoServer for critical geospatial services (utilities, emergency response, urban planning), this credential exposure can lead to data theft, service disruption, or manipulation of geographic intelligence used in operational decisions. The impact is compounded if the compromised master password is reused or stored insecurely.

Affected systems

GeoServer versions 2.26.0 through 2.26.3 and 2.27.0 through 2.27.2 are vulnerable. The vulnerability is specific to instances with the GeoServer web interface enabled. Organizations running GeoServer with headless or CLI-only deployments (no web UI) are not affected. Both community and commercial distributions of GeoServer using these version ranges require attention.

Exploitability

Exploitation requires authenticated administrator credentials, which significantly limits the attack surface compared to unauthenticated flaws. However, the ease of exploitation once access is obtained is high—attackers need only navigate to a web form and supply a file path. The attack is reproducible and deterministic. The prerequisite of admin access reflects an insider threat or prior account compromise scenario; this is a common post-exploitation move to obtain the highest-value credentials for lateral movement or persistence.

Remediation

Upgrade to GeoServer 2.26.4 or 2.27.3 or later. These versions contain fixes that properly validate and sanitize file path inputs to the Master Password Dump function. After patching, conduct a password security review: rotate the master password, audit administrative user accounts, and check logs for suspicious Master Password Dump requests. If master password compromise is suspected, reset all dependent credentials.

Patch guidance

Download and deploy GeoServer 2.26.4 or 2.27.3 from the official OsGeo repository or your distribution channel. Verify the version in the GeoServer web interface (Settings > About GeoServer) or via the REST API endpoint /rest/about/version.json before and after patching. Test patching in a non-production environment first, especially if custom authentication configurations are in use. Consider scheduling patching during a maintenance window to minimize service interruption.

Detection guidance

Monitor GeoServer access logs for requests to the Master Password Dump page (typically /web/wicket/resource/org.geoserver.web.GeoServerBasePage/PageTitle.html or similar, depending on installation). Search logs for unusual file paths or absolute path patterns in request parameters. Enable GeoServer's audit logging if available to capture administrative actions. Alert on any successful writes to unexpected file locations outside the GeoServer data directory. Additionally, review file system audit logs for new files created in system directories by the GeoServer process owner.

Why prioritize this

This vulnerability scores 7.2 (HIGH) due to high confidentiality and integrity impact coupled with high privilege requirements. While it requires admin access, the master password is the highest-value credential in GeoServer—its compromise breaks the entire security model. Organizations should prioritize patching proportionally to: (1) whether their GeoServer instances are internet-facing or contain sensitive geospatial data, (2) the number of administrators with access, and (3) the strength of identity governance controls. Critical instances should be patched within 1–2 weeks; routine instances within 30 days.

Risk score, explained

The CVSS 3.1 score of 7.2 reflects: Network attack vector (AV:N), low complexity (AC:L), high privilege requirement (PR:H), no user interaction (UI:N), and unchanged scope (S:U). The impact ratings—high confidentiality (C:H), high integrity (I:H), and high availability (A:H)—reflect that the master password enables compromise of all security functions. The high privilege prerequisite prevents a perfect score but does not diminish the severity of the outcome if the attacker already has administrative access.

Frequently asked questions