CVE-2025-58360: OSGeo GeoServer -- XXE via WMS GetMap Endpoint

Background

GeoServer is a widely deployed open-source Java-based geospatial server used by government agencies, environmental organizations, and enterprises to share and process geographic information. It supports OGC standards including WMS (Web Map Service), WFS, and WCS, making it a common component in GIS infrastructure.

CVE-2025-58360 is an XML External Entity (XXE) injection vulnerability (CWE-611) in GeoServer’s WMS GetMap operation. The /geoserver/wms endpoint accepts XML-formatted requests, and the XML parser does not properly restrict external entity resolution, allowing attackers to read files from the server filesystem or make server-side requests to internal network resources.

GeoServer has been previously targeted (CVE-2024-36401 was widely exploited in 2024), and this new XXE variant continues the pattern of attackers targeting geographic data infrastructure. CISA added this to KEV on 2025-12-11.

Technical Mechanism

CWE-611 (Improper Restriction of XML External Entity Reference) occurs when an XML parser resolves external entity references declared in the DOCTYPE of an XML document. GeoServer parses XML in the WMS GetMap request body without disabling external entity resolution.

<!-- Malicious XML payload sent to /geoserver/wms -->
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE GetMap [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<GetMap xmlns="http://www.opengis.net/wms" version="1.3.0">
  <NamedLayer>
    <Name>&xxe;</Name>  <!-- server reads /etc/passwd and includes here -->
  </NamedLayer>
  ...
</GetMap>

The server resolves the &xxe; entity, substituting the contents of /etc/passwd (or any readable file) into the XML, which is then returned in the error response or parsed data, leaking file contents to the attacker.

For SSRF exploitation, attackers replace file:// with http:// URIs targeting internal services.

Real-World Exploitation Evidence

CISA’s KEV listing confirms active exploitation. GeoServer instances are commonly internet-facing and hold sensitive geospatial datasets for government and critical infrastructure customers. XXE vulnerabilities enable attackers to exfiltrate configuration files containing database credentials, application secrets, and SSL private keys. SSRF capability can be used to pivot to internal services like metadata APIs in cloud environments, yielding cloud provider credentials.

Impact Assessment

• Read arbitrary files accessible by the GeoServer process (configs, credentials, private keys)
• Server-Side Request Forgery to internal network services and cloud metadata APIs
• Potential extraction of cloud provider credentials via IMDS (e.g., http://169.254.169.254/)
• Reconnaissance of internal network topology
• Indirect remote code execution if credential exposure enables follow-on access

Affected Versions

Remediation Steps

1. Update GeoServer to the patched version as soon as it is available.
2. As an immediate mitigation, configure the XML parser to disable external entities (set FEATURE_EXTERNAL_GENERAL_ENTITIES to false).
3. Restrict access to the /geoserver/wms endpoint via firewall rules if not required to be public.
4. Review GeoServer configuration files for signs of credential exposure.
5. Rotate database passwords and any secrets stored in GeoServer data directory.
6. Deploy a WAF rule to block DOCTYPE declarations in XML requests.

Detection Guidance

Log Sources: GeoServer access logs, web application firewall logs, network flow data.

IOCs: Requests to /geoserver/wms containing DOCTYPE or ENTITY keywords in the POST body; unusual outbound HTTP connections from GeoServer host to internal IP ranges.

Suricata rule:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (
  msg:"ET WEB GeoServer XXE via WMS GetMap CVE-2025-58360";
  flow:established,to_server;
  content:"POST"; http_method;
  content:"/geoserver/wms"; http_uri;
  content:"DOCTYPE"; http_client_body; nocase;
  content:"ENTITY"; http_client_body; nocase;
  classtype:web-application-attack;
  sid:2099005; rev:1;
)

Timeline

References

• NVD — CVE-2025-58360
• CISA KEV — CVE-2025-58360
• MITRE CVE — CVE-2025-58360