-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability is an XML External Entity (XXE) injection in the WMS GetMap operation of GeoServer. The analysis of the provided patches revealed that the vulnerability lies within the org.geoserver.sld.SLDXmlRequestReader class, specifically in the read method. This method is responsible for parsing the SLD (Styled Layer Descriptor) XML body provided in a POST request to the WMS endpoint. The patch commit feed622f2832d675d75d5b3924967596f75a0a2d shows that the call to the XML parser (styleParser.parse) was modified to include an EntityResolver. Previously, this argument was null, leading the parser to use a default configuration that allowed external entity resolution. The fix involves retrieving a secure EntityResolver from wms.getCatalog().getResourcePool().getEntityResolver() and passing it to the parser. This resolver is configured to disallow external entities, thus mitigating the XXE vulnerability. The exploitation of this vulnerability would involve this read function being called to process a malicious XML payload.
org.geoserver.sld.SLDXmlRequestReader.readsrc/wms/src/main/java/org/geoserver/sld/SLDXmlRequestReader.java
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.geoserver.web:gs-web-app | maven | >= 2.26.0, < 2.26.2 | 2.26.2 |
| org.geoserver:gs-wms | maven | >= 2.26.0, < 2.26.2 | 2.26.2 |
| org.geoserver.web:gs-web-app | maven | < 2.25.6 | 2.25.6 |
| org.geoserver:gs-wms | maven | < 2.25.6 | 2.25.6 |
A Semantic Attack on Google Gemini - Read the Latest Research