### Critical Vulnerability Information #### Vulnerability Name Improper ENTITY_RESOLUTION_ALLOWLIST URI validation in XML Processing (SSRF) #### Affected Versions - org.geoserver.main:gs-main (Maven): <2.25.0 - org.geoserver.web:gs-web-app:war (Maven): <2.25.0 #### Fixed Versions - org.geoserver.main:gs-main (Maven): 2.25.0 - org.geoserver.web:gs-web-app:war (Maven): 2.25.0 #### Vulnerability Description A vulnerability exists due to improper URI validation, allowing unauthorized attackers to perform XML External Entity (XEE) attacks, and subsequently send GET requests to any HTTP server. Attackers can exploit this to scan internal networks and gather information about them, which can then be further exploited. Additionally, attackers can read limited .xsd files on the system. #### Impact Unauthorized attackers can: 1. Scan internal networks to gather information about them and further exploit them. 2. Initiate SSRF attacks against endpoints ending with .xsd. 3. Read limited .xsd files on the system. #### Mitigation Measures 1. Define the system property ENTITY_RESOLUTION_ALLOWLIST to restrict supported external schema locations. 2. The built-in allowlist covers locations required for OGC Web service operations: www.w3.org, schemas.opengis.net, www.opengis.net, inspire.ec.europa.eu/schemas. 3. The user guide provides detailed instructions on how to add additional locations (this is where output formats are defined in the application mode plugin). #### Solution 1. GeoServer 2.25.0 and later versions default to using ENTITY_RESOLUTION_ALLOWLIST and do not require you to provide the system property. 2. If support for additional schema locations outside the built-in allowlist is needed, ENTITY_RESOLUTION_ALLOWLIST is still supported. 3. GeoServer 2.25.1 modified ENTITY_RESOLUTION_ALLOWLIST and no longer supports regular expressions. #### CVSS Score - Severity: Medium (6.5/10) - Attack Vector: Network - Attack Complexity: Low - Required Privileges: None - User Interaction: None - Scope: Unchanged - Confidentiality: Low - Integrity: None - Availability: Low #### CVE ID CVE-2024-34711 #### Weaknesses - CWE-20 - CWE-200 - CWE-611 - CWE-918 #### Reporters - lemauanhphong - jodygarnett