CVE-2023-43795: Osgeo GeoServer SSRF Vulnerability

CVE-2023-43795 Overview

CVE-2023-43795 is a critical Server-Side Request Forgery (SSRF) vulnerability in GeoServer, an open source software server written in Java that allows users to share and edit geospatial data. The vulnerability exists within the OGC Web Processing Service (WPS) specification implementation, which is designed to process information from any server using GET and POST requests. This design presents the opportunity for attackers to craft malicious requests that force the GeoServer instance to make unauthorized requests to internal or external resources.

Critical Impact

This SSRF vulnerability allows unauthenticated remote attackers to access internal network resources, potentially exposing sensitive data, internal services, and enabling further attacks against infrastructure that would otherwise be unreachable from external networks.

Affected Products

• OSGeo GeoServer versions prior to 2.22.5
• OSGeo GeoServer versions 2.23.x prior to 2.23.2
• Any deployment utilizing the OGC Web Processing Service (WPS) functionality

Discovery Timeline

• 2023-10-25 - CVE-2023-43795 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-43795

Vulnerability Analysis

The vulnerability resides in GeoServer's implementation of the OGC Web Processing Service (WPS) specification. WPS is designed to accept processing requests from clients and execute geospatial operations on server-side resources. By design, WPS allows servers to fetch data from remote URLs specified in client requests, creating an inherent SSRF risk when input validation is insufficient.

When processing WPS requests, GeoServer does not adequately validate or restrict the target URLs that can be specified in GET and POST request parameters. This allows an attacker to manipulate requests to force the GeoServer instance to make HTTP requests to arbitrary internal or external endpoints. The server-side nature of these requests means they originate from the GeoServer host, potentially bypassing firewalls, network segmentation, and access controls that would otherwise prevent direct access.

Root Cause

The root cause is classified as CWE-918 (Server-Side Request Forgery). The vulnerability stems from insufficient input validation and URL filtering in the WPS request processing logic. The OGC WPS specification inherently requires the ability to reference external data sources, but GeoServer's implementation lacks proper safeguards to prevent abuse of this functionality. Without URL allowlisting, protocol restrictions, or proper network isolation, the WPS endpoint becomes a proxy for attackers to reach internal network resources.

Attack Vector

The attack vector for this vulnerability is network-based and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending specially crafted WPS requests to a publicly accessible GeoServer instance. The malicious requests contain URLs pointing to internal network resources, cloud metadata endpoints, or other sensitive targets. When GeoServer processes these requests, it fetches content from the attacker-specified URLs and may return the results or exhibit behavior that confirms successful access.

The WPS functionality processes information from external servers using standard HTTP methods (GET and POST). An attacker can leverage this by specifying internal IP addresses, localhost references, or cloud provider metadata endpoints (such as 169.254.169.254) in the request parameters. For detailed technical information, see the GeoServer Security Advisory.

Detection Methods for CVE-2023-43795

Indicators of Compromise

• Unusual outbound HTTP requests from GeoServer servers to internal IP ranges (10.x.x.x, 172.16.x.x, 192.168.x.x)
• WPS requests containing references to cloud metadata endpoints such as 169.254.169.254
• Unexpected connections from the GeoServer host to internal services on non-standard ports
• Log entries showing WPS requests with localhost or loopback addresses in URL parameters

Detection Strategies

• Monitor GeoServer access logs for WPS endpoint requests (/wps or /ows?service=WPS) containing suspicious URL parameters
• Implement network monitoring to detect outbound connections from GeoServer to internal network segments or cloud metadata services
• Deploy web application firewall (WAF) rules to inspect and block WPS requests containing internal IP addresses or sensitive endpoints
• Configure intrusion detection systems to alert on patterns consistent with SSRF exploitation attempts

Monitoring Recommendations

• Enable verbose logging on GeoServer to capture full request details for WPS operations
• Implement egress traffic monitoring on GeoServer hosts to identify unauthorized outbound connections
• Set up alerts for any GeoServer connections to the cloud metadata IP range (169.254.169.254)
• Regularly review GeoServer logs for anomalous WPS request patterns or error messages indicating failed internal resource access

How to Mitigate CVE-2023-43795

Immediate Actions Required

• Upgrade GeoServer to version 2.22.5 or 2.23.2 immediately to address this vulnerability
• If immediate patching is not possible, consider disabling the WPS service until the upgrade can be performed
• Review network architecture to ensure GeoServer instances cannot reach sensitive internal services
• Implement network-level egress filtering to restrict outbound connections from GeoServer hosts

Patch Information

OSGeo has released patched versions of GeoServer that address this SSRF vulnerability. Organizations should upgrade to GeoServer version 2.22.5 or version 2.23.2 or later. The security patches implement proper URL validation and restrictions to prevent exploitation of the WPS functionality. Detailed information about the vulnerability and remediation is available in the GeoServer GitHub Security Advisory.

Workarounds

• Disable the WPS extension if it is not required for your deployment by removing or disabling the WPS module
• Implement network segmentation to isolate GeoServer instances from sensitive internal resources
• Deploy a reverse proxy or WAF in front of GeoServer to filter and validate incoming WPS requests
• Configure firewall rules to restrict outbound connections from GeoServer hosts to only necessary external endpoints

# Example: Disable WPS extension in GeoServer
# Navigate to GeoServer data directory and remove/rename WPS extension JAR files
cd /var/lib/geoserver/webapps/geoserver/WEB-INF/lib/
mv gs-wps-*.jar gs-wps-*.jar.disabled

# Restart GeoServer to apply changes
systemctl restart geoserver