CVE-2024-29198: GeoServer SSRF Vulnerability

CVE-2024-29198 Overview

CVE-2024-29198 is a Server-Side Request Forgery (SSRF) vulnerability affecting GeoServer, an open source Java-based geospatial data server. The flaw exists in the Demo request endpoint and is exploitable when the Proxy Base URL has not been configured. Unauthenticated attackers can abuse the TestWfsPost servlet to issue arbitrary HTTP requests originating from the GeoServer instance. This enables reconnaissance of internal networks, access to cloud metadata services, and interaction with services reachable from the server. The vulnerability is tracked as [CWE-918] and was resolved in GeoServer versions 2.24.4 and 2.25.2 by removing the affected servlet.

Critical Impact
Unauthenticated remote attackers can coerce GeoServer into issuing arbitrary HTTP requests, exposing internal services, cloud metadata endpoints, and confidential network resources.

Affected Products

OSGeo GeoServer versions prior to 2.24.4
OSGeo GeoServer 2.25.x versions prior to 2.25.2
Deployments where the Proxy Base URL setting has not been configured

Discovery Timeline

2025-06-10 - CVE-2024-29198 published to NVD
2025-08-26 - Last updated in NVD database

Technical Details for CVE-2024-29198

Vulnerability Analysis

The vulnerability resides in the TestWfsPost servlet, a demo component bundled with GeoServer to test Web Feature Service (WFS) POST requests. The servlet accepts a target URL parameter and forwards HTTP requests to that destination on behalf of the server. When the administrative Proxy Base URL has not been set, the servlet does not validate or restrict the destination, allowing arbitrary outbound requests.

Attackers exploit this by directing the servlet to internal IP ranges, loopback interfaces, or cloud provider metadata endpoints such as 169.254.169.254. Responses from these internal resources may be reflected to the attacker, enabling credential theft from instance metadata services and enumeration of internal infrastructure. The EPSS probability of 6.99% places this issue in the 91st percentile for likelihood of exploitation.

Root Cause

The TestWfsPost servlet was designed as a debugging utility and lacks destination validation. It accepts user-supplied URLs without enforcing allowlists, blocking private IP ranges, or requiring authentication. The Proxy Base URL setting, intended to constrain request targets, defaults to unset in many deployments, leaving the SSRF primitive fully exposed.

Attack Vector

Exploitation requires only network access to the GeoServer web interface. An attacker submits a crafted POST request to the demo endpoint specifying an arbitrary URL as the target. GeoServer then issues the request from its own context, bypassing perimeter firewalls and accessing resources blocked to external clients. No authentication or user interaction is required.

A typical attack workflow involves probing http://localhost, internal RFC1918 addresses, or cloud metadata services to extract IAM tokens, configuration data, or service banners. Refer to the GitHub Security Advisory GHSA-5gw5-jccf-6hxw for additional technical context.

Detection Methods for CVE-2024-29198

Indicators of Compromise

HTTP requests to /geoserver/TestWfsPost or paths referencing the demo request endpoint from unexpected source IPs
Outbound connections from GeoServer hosts to internal RFC1918 addresses, loopback interfaces, or cloud metadata endpoints such as 169.254.169.254
GeoServer access logs containing user-supplied URLs in request parameters pointing to non-WFS destinations

Detection Strategies

Inspect web server and reverse proxy logs for POST requests targeting TestWfsPost and correlate with downstream egress traffic
Deploy network monitoring rules that alert on GeoServer processes initiating connections to internal management networks or metadata services
Review GeoServer version inventory and flag any instance running below 2.24.4 or 2.25.2 as exposed

Monitoring Recommendations

Enable verbose access logging on GeoServer and forward logs to a centralized SIEM for retention and correlation
Baseline normal GeoServer egress traffic patterns and alert on deviations toward internal subnets
Monitor cloud provider audit logs for IAM credential use originating from GeoServer instance roles

How to Mitigate CVE-2024-29198

Immediate Actions Required

Upgrade GeoServer to version 2.24.4, 2.25.2, or later, which remove the vulnerable TestWfsPost servlet
Configure the Proxy Base URL setting in the GeoServer administration console to restrict request handling
Restrict network egress from GeoServer hosts to deny outbound traffic to internal management networks and cloud metadata endpoints

Patch Information

The GeoServer maintainers resolved the issue by removing the TestWfsPost servlet entirely. Fixed releases are GeoServer 2.24.4 and 2.25.2. Patch details and release notes are available in the GitHub Security Advisory GHSA-5gw5-jccf-6hxw and the OSGeo issue tracker entry GEOS-11390.

Workarounds

Remove or disable the TestWfsPost servlet by editing the web.xml deployment descriptor if upgrading is not immediately feasible
Block access to /geoserver/TestWfsPost at the reverse proxy or web application firewall layer
Place GeoServer behind network segmentation that restricts outbound connectivity to only required geospatial data sources

bash

# Block the TestWfsPost endpoint at the reverse proxy (nginx example)
location ~* /geoserver/TestWfsPost {
    deny all;
    return 403;
}