CVE-2024-34711
📋 TL;DR
This vulnerability in GeoServer allows unauthorized attackers to perform XML External Entity (XXE) attacks by bypassing URI validation. Attackers can send GET requests to any HTTP server, potentially scanning internal networks and gathering information for further exploitation. All GeoServer versions before 2.25.0 with default configurations are affected.
💻 Affected Systems
- GeoServer
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete network reconnaissance, data exfiltration from internal systems, and potential lateral movement leading to full network compromise.
Likely Case
Internal network scanning, information disclosure about internal services and infrastructure, and potential credential harvesting.
If Mitigated
Limited impact with proper network segmentation and egress filtering, though some information disclosure may still occur.
🎯 Exploit Status
The vulnerability is straightforward to exploit as it bypasses regex-based filtering. Attackers need to craft malicious XML with external entity references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.25.0 and later
Vendor Advisory: https://github.com/geoserver/geoserver/security/advisories/GHSA-mc43-4fqr-c965
Restart Required: Yes
Instructions:
1. Upgrade to GeoServer 2.25.0 or later. 2. If upgrading is not possible, set system property 'org.geotools.xml.externalEntitiesEnabled' to 'false'. 3. Restart GeoServer service.
🔧 Temporary Workarounds
Disable external entity processing
allConfigure GeoServer to disable XML external entity processing entirely
java -Dorg.geotools.xml.externalEntitiesEnabled=false -jar start.jar
Configure entity resolution allowlist
allManually configure ENTITY_RESOLUTION_ALLOWLIST in older versions
Set system property 'org.geotools.xml.entityResolutionAllowList' to restrict allowed URIs
🧯 If You Can't Patch
- Implement strict network egress filtering to block outbound requests from GeoServer
- Deploy GeoServer in a segmented network zone with limited access to internal resources
🔍 How to Verify
Check if Vulnerable:
Check GeoServer version and verify if external entity processing is enabled without proper restrictionsCheck Version:
Check GeoServer web interface admin panel or examine startup logs for version informationVerify Fix Applied:
Verify GeoServer version is 2.25.0+ or system property 'org.geotools.xml.externalEntitiesEnabled' is set to false📡 Detection & Monitoring
Log Indicators:
- Unusual XML parsing errors
- Outbound HTTP requests from GeoServer to unexpected destinations
- Multiple failed entity resolution attempts
Network Indicators:
- HTTP GET requests from GeoServer to internal IP ranges
- Unusual outbound traffic patterns from GeoServer instance
SIEM Query:
source="geoserver" AND (http_method="GET" AND NOT dest_ip IN allowed_destinations)