CVE-2024-34711: OSGeo GeoServer XXE Vulnerability

CVE-2024-34711 Overview

CVE-2024-34711 is an XML External Entity (XXE) vulnerability in GeoServer, an open source server for sharing and editing geospatial data. The flaw stems from improper Uniform Resource Identifier (URI) validation in the PreventLocalEntityResolver class inherited from GeoTools. The resolver applies the regex (?i)(jar:file|http|vfs)[^?#;]*\.xsd to filter malicious URIs, but the pattern allows attackers to issue HTTP GET requests to arbitrary servers or reference limited files. Unauthenticated attackers can abuse this to scan internal networks, fingerprint internal services, and stage further exploitation. GeoServer 2.25.0 and later default to ENTITY_RESOLUTION_ALLOWLIST and no longer require a system property to enforce stricter resolution.

Critical Impact
Unauthenticated attackers can trigger XXE-based server-side requests to internal HTTP services, enabling network reconnaissance and information disclosure [CWE-200].

Affected Products

OSGeo GeoServer versions prior to 2.25.0
GeoTools PreventLocalEntityResolver component
Deployments relying on default entity resolution without ENTITY_RESOLUTION_ALLOWLIST

Discovery Timeline

2025-06-10 - CVE-2024-34711 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-34711

Vulnerability Analysis

GeoServer processes XML documents submitted through its OGC service endpoints, including Web Feature Service (WFS) and Web Map Service (WMS) requests. To defend against XML External Entity (XXE) attacks, GeoTools provides the PreventLocalEntityResolver class, which inspects URIs referenced by XML entities before resolving them. The resolver enforces the regular expression (?i)(jar:file|http|vfs)[^?#;]*\.xsd and rejects URIs that do not match.

The regex is intended to restrict external references to XML Schema Definition (.xsd) files retrieved over approved schemes. However, the character class [^?#;]* only excludes query, fragment, and parameter separators. Attackers can craft URIs that satisfy the .xsd suffix requirement while still pointing the resolver at arbitrary HTTP endpoints. The server then issues an outbound GET request during entity resolution, returning timing and response signals that expose internal hosts and services.

Root Cause

The root cause is an information exposure weakness [CWE-200] driven by an under-restrictive allowlist regex. The pattern validates the URI suffix but not its full structure, so attackers can append .xsd to URLs targeting internal services. The resolver treats these URIs as trusted schema references and dispatches the request without further validation.

Attack Vector

The vulnerability is reachable over the network without authentication or user interaction. An attacker submits a crafted XML payload, such as a WFS GetFeature or transactional request, containing a malicious DOCTYPE or entity declaration that references an external URI ending in .xsd. GeoServer resolves the entity, issuing an HTTP request to the attacker-controlled or internal target. The attacker uses response codes, latency, and error content to map internal infrastructure or retrieve content from reachable HTTP endpoints.

No public proof-of-concept exploit code is associated with this CVE. Refer to the GitHub Security Advisory GHSA-mc43-4fqr-c965 for vendor-supplied technical details.

Detection Methods for CVE-2024-34711

Indicators of Compromise

Inbound XML payloads to GeoServer endpoints containing <!DOCTYPE, <!ENTITY, or SYSTEM declarations referencing external URIs ending in .xsd
Outbound HTTP requests from the GeoServer host to internal IP ranges or unexpected external domains during XML parsing
Unusual User-Agent strings such as Java URL connection clients originating from the GeoServer process

Detection Strategies

Inspect GeoServer access logs for OGC requests (WFS, WMS, WPS) containing XML payloads with DOCTYPE or external entity declarations
Correlate web server request logs with outbound network connections from the GeoServer JVM to identify entity-driven server-side requests
Deploy web application firewall (WAF) rules that flag XML payloads referencing http://, jar:file:, or vfs: URIs in submitted documents

Monitoring Recommendations

Alert on outbound HTTP connections from GeoServer to private IP ranges (RFC1918) or metadata services such as 169.254.169.254
Monitor for spikes in .xsd retrievals originating from the GeoServer process to non-allowlisted hosts
Capture and review JVM-level network telemetry to detect anomalous URL fetches during XML parsing windows

How to Mitigate CVE-2024-34711

Immediate Actions Required

Upgrade GeoServer to version 2.25.0 or later, where ENTITY_RESOLUTION_ALLOWLIST is enabled by default
Restrict outbound network access from GeoServer hosts to only the destinations required for legitimate schema resolution
Place GeoServer behind a reverse proxy or WAF that inspects and sanitizes inbound XML payloads

Patch Information

The vendor addressed the flaw in GeoServer 2.25.0 by switching the default entity resolution behavior to an allowlist model. Administrators no longer need to set a system property to enforce safe resolution. Review the GitHub Security Advisory GHSA-mc43-4fqr-c965 and the GeoServer Configuration Guide for upgrade and hardening steps.

Workarounds

For deployments that cannot upgrade immediately, configure the ENTITY_RESOLUTION_ALLOWLIST system property to restrict permitted external schema hosts
Disable processing of inline DOCTYPE declarations at the application or proxy layer when feasible
Apply egress firewall rules that block GeoServer from initiating connections to internal management interfaces and cloud metadata endpoints

bash

# Configuration example: enforce GeoServer entity resolution allowlist
# Set as a JVM system property when starting GeoServer (pre-2.25.0 deployments)
export JAVA_OPTS="$JAVA_OPTS \
  -DENTITY_RESOLUTION_ALLOWLIST=schemas.opengis.net,www.w3.org,inspire.ec.europa.eu"

# Restart GeoServer / servlet container to apply