CVE-2024-29198 PoC — GeoServer 代码问题漏洞

Source

https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-29198.yaml

Associated Vulnerability

Title:GeoServer 代码问题漏洞 (CVE-2024-29198)
Description:GeoServer是GeoServer开源的一个用 Java 编写的开源软件服务器。允许用户共享和编辑地理空间数据。 GeoServer存在代码问题漏洞，该漏洞源于未设置Proxy Base URL时可通过Demo请求端点实现服务端请求伪造。

Description

It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.

File Snapshot


 id: CVE-2024-29198

info:
  name: GeoServer Demo Request Endpoint - Server Side Request Forgery
  au

...

Shenlong Bot has cached this for you

Remarks

1. It is advised to access via the original source first.

2. If the original source is unavailable, please email f.jinxu#gmail.com for a local snapshot (replace # with @).

3. Shenlong has snapshotted the POC code for you. To support long-term maintenance, please consider donating. Thank you for your support.

Goal Reached Thanks to every supporter — we hit 100%!