Description
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| geoserver | geoserver | >= 2.0.0, < 2.24.4, >= 2.25.0, < 2.25.2 | — |
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- GeoServer Demo Request Endpoint - Server Side Request Forgery http/cves/2024/CVE-2024-29198.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.geoserver:gs-wfs | >= 2.0.0, < 2.24.4 | 2.24.4 | GHSA-5gw5-jccf-6hxw |
| Maven | org.geoserver:gs-wfs | >= 2.25.0, < 2.25.2 | 2.25.2 | GHSA-5gw5-jccf-6hxw |
| Maven | org.geoserver.web:gs-app | >= 2.0.0, < 2.24.4 | 2.24.4 | GHSA-5gw5-jccf-6hxw |
| Maven | org.geoserver.web:gs-app | >= 2.25.0, < 2.25.2 | 2.25.2 | GHSA-5gw5-jccf-6hxw |
Advisories 1
- WID-SEC-2025-1294 GeoServer: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jun 10, 2025