CVE-2025-21621
📋 TL;DR
GeoServer versions before 2.25.0 contain a reflected cross-site scripting vulnerability in the WMS GetFeatureInfo HTML output format. Attackers can inject malicious JavaScript via SLD_BODY parameters, which executes in victims' browsers when they visit manipulated URLs. This affects all GeoServer instances with WMS service enabled.
💻 Affected Systems
- GeoServer
📦 What is this software?
Geoserver by Geoserver
⚠️ Risk & Real-World Impact
Worst Case
Attackers steal session cookies, perform actions as authenticated users, redirect to malicious sites, or install malware via browser exploits.
Likely Case
Session hijacking, credential theft, or defacement of GeoServer interfaces through injected content.
If Mitigated
Limited to same-origin policy restrictions; modern browser XSS protections may partially block exploitation.
🎯 Exploit Status
Reflected XSS typically requires social engineering to trick users into clicking malicious links.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.25.0
Vendor Advisory: https://github.com/geoserver/geoserver/security/advisories/GHSA-w66h-j855-qr72
Restart Required: Yes
Instructions:
1. Backup current GeoServer configuration. 2. Download GeoServer 2.25.0 or later from official site. 3. Stop GeoServer service. 4. Replace with patched version. 5. Restart GeoServer service.
🔧 Temporary Workarounds
Disable WMS GetFeatureInfo HTML Output
allDisable vulnerable output format while maintaining other WMS functionality.
Edit web.xml to remove or restrict GetFeatureInfo HTML format mappings
Web Application Firewall Rules
allBlock requests containing suspicious SLD_BODY parameters or JavaScript patterns.
Configure WAF to filter: SLD_BODY parameter with script tags or JavaScript patterns
🧯 If You Can't Patch
- Implement Content Security Policy headers to restrict script execution
- Use reverse proxy to sanitize SLD_BODY parameters before reaching GeoServer
🔍 How to Verify
Check if Vulnerable:
Test by accessing WMS GetFeatureInfo endpoint with SLD_BODY parameter containing test payload like <script>alert('test')</script>Check Version:
Check GeoServer version in web interface or via REST endpoint: curl -s http://geoserver-host:8080/geoserver/rest/about/version.jsonVerify Fix Applied:
After patching, same test payload should be properly escaped or rejected.📡 Detection & Monitoring
Log Indicators:
- HTTP requests with SLD_BODY parameter containing script tags or JavaScript code
- Unusual GetFeatureInfo requests from single IPs
Network Indicators:
- HTTP requests with encoded script payloads in parameters
- Abnormal traffic to WMS endpoints
SIEM Query:
source="geoserver.log" AND "SLD_BODY" AND ("<script>" OR "javascript:")