-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJavaMiggo AIRoot Cause AnalysisThe root cause of the vulnerability is an improper URI validation regex (?i)(jar:file|http|vfs)[^?#;]*\\.xsd within the org.geotools.util.PreventLocalEntityResolver class, part of the GeoTools library. This regex allows an attacker to specify arbitrary HTTP URLs (ending in .xsd) or certain file URIs for XML external entities, leading to SSRF and potential local file access.
GeoServer's vulnerability (CVE-2024-34711 / GHSA-mc43-4fqr-c965) stemmed from its default behavior of using this vulnerable PreventLocalEntityResolver when no ENTITY_RESOLUTION_ALLOWLIST system property was configured or if it was left empty. The GeoServer functions org.geoserver.util.EntityResolverProvider.entityResolutionAllowlist() and org.geoserver.util.EntityResolverProvider.getEntityResolver() were responsible for this default selection.
The patch (commit 87a73326940da64fd56b888a8c2785d868b87b7a) mitigates this by changing GeoServer's default. It ensures that EntityResolverProvider.entityResolutionAllowlist() now returns a predefined, safe list of allowed domains (W3C, OGC, Inspire schemas) if the ENTITY_RESOLUTION_ALLOWLIST property is not set. Consequently, EntityResolverProvider.getEntityResolver() now defaults to using org.geoserver.util.AllowListEntityResolver (which consumes this safe list) instead of the vulnerable PreventLocalEntityResolver.
During exploitation in a vulnerable version, a request with a malicious XML payload would cause the XML parser to invoke org.geotools.util.PreventLocalEntityResolver.resolveEntity(...). This function would then apply the flawed regex, allowing the SSRF or file access. The GeoServer EntityResolverProvider methods would appear earlier in the call stack related to setting up the XML parser's entity resolution strategy.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.geoserver.web:gs-web-app | maven | < 2.25.0 | 2.25.0 |
| org.geoserver.main:gs-main | maven | < 2.25.0 | 2.25.0 |