7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-52465

CVE-2025-52465: GeoServer has an arbitrary file write vulnerability in its Master Password Dump Page

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.26.4 and 2.27.3, a vulnerability exists that allows an authenticated administrator with access to GeoServer's security system to pass arbitrary file names to the Master Password Dump web page and create files containing the master password in plaintext. The provided file name must be an absolute path to the target file, the target file can not already exist and all parent directories must already exist. Versions 2.26.4 and 2.27.3 contain a fix. GeoServer installations where the web interface is either disabled or completely removed are not affected since the vulnerability exists in one of the web pages.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-52465

CVE-2025-52465:

7.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
org.geoserver.web:gs-web-app	maven	>= 2.27.0, <= 2.27.2	2.27.3
org.geoserver.web:gs-web-sec-core	maven	>= 2.27.0, <= 2.27.2	2.27.3
org.geoserver.web:gs-web-sec-core	maven	<= 2.26.3	2.26.4
org.geoserver.web:gs-web-app	maven	<= 2.26.3	2.26.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability exists in the 'Master Password Dump' feature of GeoServer, which allowed an authenticated administrator to write the master password to a file. The analysis of the provided patch, specifically commit e20452f73aea7faa7ac9f2e4b8d63a1b0279dd93, reveals the vulnerable components. The web interface for this feature was handled by org.geoserver.security.web.passwd.MasterPasswordInfoPage. The onSubmit method in this class took a filename from the user. This filename was then used in the dumpMasterPassword method of the same class, which in turn called org.geoserver.security.GeoServerSecurityManager.dumpMasterPassword. The core of the vulnerability is the lack of validation on the provided filename, which allowed for an arbitrary file write using an absolute path. An attacker could leverage this to write a file containing the master password to any location where the GeoServer process has write permissions. This could lead to remote code execution if the file is written to a location that allows code execution (like a web server's document root with a .jsp extension). The fix applied was to completely remove the 'Master Password Dump' page and its associated backend logic, thus eliminating the vulnerable functionality.

Vulnerable functions

org.geoserver.security.web.passwd.MasterPasswordInfoPage.dumpMasterPassword

src/web/security/core/src/main/java/org/geoserver/security/web/passwd/MasterPasswordInfoPage.java

This function is vulnerable because it takes a user-controlled filename (`fileName`) from the web interface and uses it to create a `File` object. This file object is then passed to `GeoServerSecurityManager.dumpMasterPassword`, which writes the master password to the specified file. There is no validation to prevent the use of absolute paths, allowing an authenticated administrator to write a file to an arbitrary location on the filesystem.

org.geoserver.security.GeoServerSecurityManager.dumpMasterPassword

src/main/src/main/java/org/geoserver/security/GeoServerSecurityManager.java

This function performs the file write operation. It receives a `Resource` object created from a user-provided path via the `MasterPasswordInfoPage`. The function does not properly sanitize the file path, allowing an administrator to write the master password to an arbitrary file on the server. This can be abused for remote code execution by writing to a web-accessible directory with executable permissions (e.g., a JSP file in a Tomcat webapps directory).

org.geoserver.security.web.passwd.MasterPasswordInfoPage$1.onSubmit

src/web/security/core/src/main/java/org/geoserver/security/web/passwd/MasterPasswordInfoPage.java

This method is the entry point for the vulnerability from the web user interface. When an administrator clicks the 'save' button on the Master Password Dump page, this method is invoked. It retrieves the user-provided filename and initiates the process of dumping the master password by calling the vulnerable `dumpMasterPassword()` method.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.