CVE-2023-43795
📋 TL;DR
This vulnerability in GeoServer's OGC Web Processing Service (WPS) allows Server-Side Request Forgery (SSRF), enabling attackers to make unauthorized requests from the server to internal or external systems. It affects all GeoServer installations with WPS enabled. Organizations using vulnerable GeoServer versions for geospatial data sharing are at risk.
💻 Affected Systems
- GeoServer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of internal network via SSRF to access sensitive internal services, data exfiltration, or lateral movement.
Likely Case
Unauthorized access to internal services, data leakage, or denial of service through resource exhaustion.
If Mitigated
Limited impact if network segmentation restricts internal access and WPS is disabled or properly configured.
🎯 Exploit Status
SSRF vulnerabilities typically have low exploitation complexity when unauthenticated access is available.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.22.5 or 2.23.2
Vendor Advisory: https://github.com/geoserver/geoserver/security/advisories/GHSA-5pr3-m5hm-9956
Restart Required: Yes
Instructions:
1. Download GeoServer 2.22.5 or 2.23.2 from official sources. 2. Backup current installation. 3. Replace with patched version. 4. Restart GeoServer service.
🔧 Temporary Workarounds
Disable WPS Service
allCompletely disable the Web Processing Service if not required.
Edit web.xml to remove WPS servlet mapping or set wps.enabled=false in configuration
Network Segmentation
allRestrict GeoServer's network access to prevent SSRF to sensitive systems.
Configure firewall rules to limit outbound connections from GeoServer
🧯 If You Can't Patch
- Implement strict network segmentation to isolate GeoServer from sensitive internal systems
- Deploy web application firewall (WAF) with SSRF protection rules
🔍 How to Verify
Check if Vulnerable:
Check GeoServer version and verify WPS is enabled in configuration.Check Version:
Check WEB-INF/version.txt or use admin interface at /geoserver/web/Verify Fix Applied:
Confirm version is 2.22.5 or 2.23.2 via admin interface or version file.📡 Detection & Monitoring
Log Indicators:
- Unusual WPS request patterns
- Requests to internal IP addresses from GeoServer logs
Network Indicators:
- GeoServer making unexpected outbound connections to internal services
SIEM Query:
source="geoserver" AND (uri="*wps*" OR method="POST") AND dest_ip IN (internal_ranges)