geoserver-exploit

GeoServer vulnerability exploitation skill

GeoServer is a Java-based open source GIS server that supports OGC standards (WMS/WFS/WPS). This skill covers five types of exploitation methods.

Target information

• Default port：8080 | Default credentials：admin / geoserver | Path：/geoserver/web/
• Technology stack: Java (Spring), GeoTools, WMS/WFS/WPS OGC services
• Version detection：/geoserver/rest/about/version.json(requires authentication) or /geoserver/web/ page

Vulnerability decision tree

发现 GeoServer
  |-- 版本 < 2.23.5/2.24.3/2.25.1 --> CVE-2024-36401 XPath RCE (P0)
  |-- 版本 <= 2.25.5/2.26.0-2.26.1 --> CVE-2025-58360 XXE 文件读取 (P0)
  |-- 版本 < 2.18.6/2.19.6/2.20.4  --> CVE-2022-24816 Jiffle RCE (P1)
  |-- 后端 PostGIS + 版本 < 2.21.4  --> CVE-2023-25157 SQL注入 (P1)
  |-- 版本 < 2.17.6/2.18.5/2.19.3  --> CVE-2021-40822 SSRF (P2)

Vulnerability overview

CVE	Type	Authentication	Impact	Severity	Affected versions
CVE-2024-36401	OGC XPath RCE	Not required	Remote code execution	Critical	< 2.23.5/2.24.3/2.25.1
CVE-2025-58360	WMS XXE	Not required	File read/SSRF	Critical	<= 2.25.5/2.26.0-2.26.1
CVE-2022-24816	Jiffle RCE	Not required	Remote code execution	High risk	< 2.18.6/2.19.6/2.20.4
CVE-2023-25157	SQL injection	Not required	Database leakage	High risk	< 2.21.4/2.22.1
CVE-2021-40822	SSRF	Not required	Internal network probing	Medium risk	< 2.17.6/2.18.5/2.19.3

Quick detection reference

Priority	CVE	Detection method	Indicator
P0	CVE-2024-36401	GET WFS GetPropertyValue + XPath exec()	Returns ClassCastException
P0	CVE-2025-58360	POST XXE to OWS WMS GetMap	Error message contains file contents
P1	CVE-2022-24816	POST Jiffle script to WMS WPS	Exception contains command output
P1	CVE-2023-25157	CQL_FILTER injection	SQL error message leakage
P2	CVE-2021-40822	POST TestWfsPost	Response contains target URL contents

Notes

• typeNames is a required parameter for CVE-2024-36401, obtained through the web interface or GetCapabilities
• CVE-2023-25157 requires the backend to have a PostGIS data source configured
• The SSRF in CVE-2021-40822 is constrained by consistency between the Host header and the URL domain

Detailed reference documentation

• CVE-2024-36401 XPath RCE exploitation details -- GET/POST command execution, reverse shell script, typeNames discovery
• CVE-2025-58360 XXE file read and SSRF -- File read, directory listing, SSRF, batch scanning script
• Jiffle RCE / SQL injection / SSRF and comprehensive detection -- CVE-2022-24816 Jiffle injection, CVE-2023-25157 SQL injection, CVE-2021-40822 SSRF, one-click detection script