5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-27505

CVE-2025-27505: GeoServer Missing Authorization on REST API Index

Summary

It is possible to bypass the default REST API security and access the index page.

Details

The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html).

Impact

The REST API index can disclose whether certain extensions are installed.

Workaround

In ${GEOSERVER_DATA_DIR}/security/config.xml, change the paths for the rest filter to /rest.*,/rest/** and change the paths for the gwc filter to /gwc/rest.*,/gwc/rest/** and restart GeoServer.

References

https://osgeo-org.atlassian.net/browse/GEOS-11664
https://osgeo-org.atlassian.net/browse/GEOS-11776
https://github.com/geoserver/geoserver/pull/8170

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-27505

CVE-2025-27505:

5.3

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.geoserver.web:gs-web-app	maven	>= 2.26.0, < 2.26.3	2.26.3
org.geoserver.web:gs-web-app	maven	< 2.25.6	2.25.6
org.geoserver:gs-rest	maven	>= 2.26.0, < 2.26.3	2.26.3
org.geoserver:gs-rest	maven	< 2.25.6	2.25.6

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability (CVE-2025-27505) in GeoServer allows bypassing REST API security to access the index page. This is due to an improper path pattern configuration in its Spring Security setup. The patterns /rest/** and /gwc/rest/** were used to define which requests should be processed by the REST security filter chain (which includes org.geoserver.security.ServiceLoginFilterChain for authentication and authorization).

However, these patterns did not correctly match paths that included an extension, such as /rest.html or /gwc/rest.html. As a result, the org.geoserver.security.GeoServerSecurityFilterChainProxy.doFilter method, which is responsible for applying the correct filter chain based on the request path, would not route these specific requests through the intended security filters.

This bypass allowed unauthenticated users to access the REST API index pages (likely served by methods within org.geoserver.rest.IndexController), potentially disclosing information about installed GeoServer extensions.

The fix, as seen in commit 3534561e66ad3f483c0a29d53e608875fed0a3a2, involved updating these path patterns in various security/config.xml files and in the GeoServerSecurityFilterChain.java constants to /rest.*,/rest/** and /gwc/rest.*,/gwc/rest/**. These new patterns correctly cover paths with and without extensions, ensuring that all intended REST API endpoints are protected. The GeoServerSecurityManager.migrateFrom25() method was also added to automatically update existing configurations from the old, vulnerable patterns to the new, secure ones.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.