CVE-2025-58175: GeoServer SSRF Vulnerability in Proxy Configuration

Technical summary

The vulnerability arises from insufficient input validation in the entity resolution mechanism when a proxy base URL is misconfigured. Specifically, when the proxy base URL does not contain a path or conclude with a slash, the allowlist bypass permits crafted requests to traverse security boundaries. This allows unauthenticated attackers to trigger SSRF conditions, leading to potential exposure of confidential information (high confidentiality impact) and limited availability degradation (low availability impact). The attack requires complex conditions (AC:H), explaining the MEDIUM CVSS score of 6.5, but carries high practical risk due to the default enablement of entity resolution allowlist since v2.25.0.

Business impact

Organizations deploying vulnerable GeoServer instances risk unauthorized access to internal network resources, metadata disclosure, and potential lateral movement within infrastructure. If GeoServer serves as a gateway to proprietary geospatial datasets or connects to backend services, attackers could exfiltrate sensitive location data or disrupt service availability for dependent applications. The vulnerability's non-exploitation status on the KEV catalog suggests active exploitation is not yet widespread, but organizations should treat this as a prompt remediation priority given the unauthenticated attack vector and default-enabled trigger conditions.

Affected systems

GeoServer versions 2.26.x (before 2.26.4) and 2.27.x (before 2.27.3) are affected. Earlier versions prior to 2.25.0 are not affected because the entity resolution allowlist was not enabled by default. The vulnerability requires concurrent presence of three conditions: (1) GeoServer configured to use a proxy base URL, (2) that proxy base URL lacking a path component or trailing slash, and (3) entity resolution allowlist feature enabled (default for 2.25.0+). Installations with properly formatted proxy URLs (containing a path or ending with /) are not vulnerable to this specific SSRF vector.

Exploitability

The attack requires no authentication and is network-accessible, increasing surface risk. However, successful exploitation demands specific server configuration (AC:H), limiting widespread exposure. Attackers must identify GeoServer instances, verify proxy base URL configuration (often discoverable through error messages or endpoint probing), and craft SSRF payloads targeting internal services. The complexity requirement keeps this from CRITICAL severity, but organizations with non-standard or hastily deployed GeoServer configurations are at elevated risk. No public exploit code is known to be circulating, but the technical barrier is moderate.

Remediation

Upgrade to GeoServer 2.26.4 or 2.27.3 or later immediately. As an interim mitigation before patching, append a trailing slash to any proxy base URL that lacks one, or ensure the URL contains a path component (e.g., change 'http://proxy.example.com' to 'http://proxy.example.com/' or 'http://proxy.example.com/geoserver'). This reconfiguration can be applied without code changes and should be validated in a staging environment first.

Patch guidance

Download and deploy GeoServer 2.26.4 (for the 2.26.x line) or 2.27.3 (for the 2.27.x line) or any later stable release from the official GeoServer repository. Review release notes to confirm SSRF fix inclusion and assess compatibility with custom extensions or plugins. Test patched deployments in a non-production environment, paying special attention to proxy routing and entity resolution behavior. Monitor application logs post-upgrade for any configuration drift or unexpected request patterns.

Detection guidance

Examine GeoServer proxy base URL configuration in web.xml, REST API configuration endpoints, or the web console to identify instances lacking a trailing slash or path component. Monitor access logs for suspicious SSRF patterns: requests to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16), localhost, or internal hostnames originating from unauthenticated sources. Look for POST/GET requests to entity resolution or data store configuration endpoints with unusual payloads or URL-encoded content. Enable debug logging for entity resolution to capture allowlist bypass attempts.

Why prioritize this

Despite MEDIUM CVSS, this warrants prompt attention due to unauthenticated attack surface, default-enabled trigger (entity resolution allowlist since 2.25.0), and the sensitive nature of geospatial data. Organizations running GeoServer 2.25.0+ with a proxy base URL should prioritize verification of their configuration and patch deployment within 30 days. The non-KEV status indicates this is not yet being actively exploited at scale, providing a window for proactive remediation before threat actors develop targeted campaigns.

Risk score, explained

The CVSS 6.5 MEDIUM score reflects high confidentiality impact (unauthenticated information disclosure), low availability impact, unauthenticated network access, but requires high attack complexity due to specific proxy configuration prerequisites. The score appropriately captures the vulnerability's severity without overstating it as CRITICAL, since many GeoServer deployments may not meet all three exploitation conditions. However, the default enablement of entity resolution allowlist since v2.25.0 elevates the practical prevalence of vulnerable configurations.

Frequently asked questions