-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.geoserver.web:gs-web-app | maven | < 2.25.0 | 2.25.0 |
| org.geoserver:gs-wms | maven | < 2.25.0 | 2.25.0 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability is a reflected Cross-Site Scripting (XSS) issue in GeoServer's WMS GetFeatureInfo HTML output format. The root cause is that HTML auto-escaping for the FreeMarker templates used to generate this output was disabled by default.
Analysis of the provided patch from pull request #7406, specifically commit 913f0d6e6bf9b09f3e93aa6bc9f33ed3cf976ef2, points directly to the vulnerable code. The changes are centered in src/wms/src/main/java/org/geoserver/wms/featureinfo/FreeMarkerTemplateManager.java.
The key identified vulnerable function is org.geoserver.wms.featureinfo.FreeMarkerTemplateManager.getTemplate. Before the patch, this function would only enable auto-escaping (templateConfig.setOutputFormat(HTMLOutputFormat.INSTANCE)) if a specific WMS setting (wms.isAutoEscapeTemplateValues()) was explicitly enabled. Since this setting was off by default, any GetFeatureInfo request that resulted in HTML output was vulnerable to XSS if user-provided data was reflected in the response.
A second critical function, org.geoserver.wms.featureinfo.HTMLFeatureInfoOutputFormat.write, is the entry point that handles the request and produces the vulnerable HTML. While the logical flaw was in getTemplate, the write function is the one that would be seen in a runtime profile as it orchestrates the entire process of generating the unsafe output. The associated test file confirms that outputFormat.write(...) is the method that triggers the vulnerable output generation.
org.geoserver.wms.featureinfo.FreeMarkerTemplateManager.getTemplatesrc/wms/src/main/java/org/geoserver/wms/featureinfo/FreeMarkerTemplateManager.java
org.geoserver.wms.featureinfo.HTMLFeatureInfoOutputFormat.writesrc/wms/src/main/java/org/geoserver/wms/featureinfo/HTMLFeatureInfoOutputFormat.java
Ongoing coverage of React2Shell