CVE-2024-35230: GeoServer Information Disclosure Vulnerability

CVE-2024-35230 Overview

GeoServer is an open-source Java server for sharing and editing geospatial data. The welcome and about pages in affected versions expose version and revision details for GeoServer and its bundled libraries. This information disclosure allows unauthenticated attackers to fingerprint the exact software stack running on the server. Once identified, attackers can correlate versions with known Common Vulnerabilities and Exposures (CVEs) to plan targeted follow-on attacks. The issue is tracked under [CWE-200] Exposure of Sensitive Information to an Unauthorized Actor. Maintainers resolved the flaw in GeoServer 2.26.0 by hiding build and revision details from non-administrative users.

Critical Impact
Unauthenticated remote attackers can enumerate GeoServer version, Git revision, GeoTools, and GeoWebCache component versions to identify exploitable known vulnerabilities.

Affected Products

OSGeo GeoServer versions prior to 2.26.0
GeoServer welcome page (GeoServerHomePage)
GeoServer about page (AboutGeoServerPage)

Discovery Timeline

2024-12-16 - CVE-2024-35230 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-35230

Vulnerability Analysis

The vulnerability is an information exposure issue in the GeoServer web interface. The welcome page footer and the About GeoServer page rendered build metadata to any visitor. Exposed values included the GeoServer version string, Git build revision, build date, GeoTools version and revision, and GeoWebCache version and revision. None of these fields required authentication to view. Attackers can retrieve them with a simple HTTP GET request against a public GeoServer instance.

This metadata gives adversaries precise fingerprinting of the deployed stack. Version identification directly enables mapping to known GeoServer and GeoTools CVEs, including remote code execution flaws such as CVE-2024-36401. The disclosure lowers the reconnaissance burden required before launching an exploitation attempt.

Root Cause

The root cause is missing access control on build-metadata rendering. Both GeoServerBasePage.java and AboutGeoServerPage.html emitted version and revision labels unconditionally. The templates did not check whether the requesting session belonged to an administrative user before rendering component versions.

Attack Vector

Exploitation requires only network reachability to the GeoServer web interface. An attacker sends an HTTP request to the welcome page or /web/wicket/bookmarkable/org.geoserver.web.AboutGeoServerPage endpoint and parses returned HTML for version fields.

java

// Patch: src/web/core/src/main/java/org/geoserver/web/GeoServerHomePage.java
// Restrict footer version rendering to administrators only
private Label footerMessage(ContactInfo contactInfo, Locale locale) {
    String version = String.valueOf(new ResourceModel("version").getObject());

    boolean admin = getSession().isAdmin();
    if (!admin) {
        Label footerMessage = new Label("footerMessage", "");
        return footerMessage;
    }

    HashMap<String, String> params = new HashMap<>();
    params.put("version", version);
}

Source: GeoServer commit 74fdab7

Detection Methods for CVE-2024-35230

Indicators of Compromise

HTTP GET requests to /geoserver/web/ or /geoserver/web/wicket/bookmarkable/org.geoserver.web.AboutGeoServerPage from unauthenticated sources
Response bodies containing buildInformation, geoserverVersion, gitRevision, geotoolsVersion, or geowebcacheVersion HTML labels
Repeated scanning patterns targeting the GeoServer welcome page from single source IPs

Detection Strategies

Inspect web access logs for anonymous requests to GeoServer welcome and about endpoints and correlate with subsequent exploitation attempts against known GeoServer CVEs
Deploy a reverse proxy rule that flags outbound HTML responses containing version and revision fields when the requestor is unauthenticated
Baseline expected administrative traffic to the About page and alert on volume anomalies

Monitoring Recommendations

Enable full HTTP request and response logging on GeoServer front-end proxies
Forward web server logs into a centralized analytics platform for retention and correlation
Track user-agent strings and source IPs performing reconnaissance across geospatial services

How to Mitigate CVE-2024-35230

Immediate Actions Required

Upgrade all GeoServer instances to version 2.26.0 or later
Restrict network exposure of the GeoServer administrative and web console to trusted networks or VPN users
Audit web access logs for prior reconnaissance targeting the welcome and about pages
Review any known GeoServer, GeoTools, and GeoWebCache CVEs applicable to the previously disclosed versions and confirm patch status

Patch Information

The fix is delivered in GeoServer 2.26.0. Commit 74fdab7 hides version details in the base page footer for non-administrators. Commit 8cd1590 removes the build information block from the About GeoServer page for unauthenticated users. Full details are in the GitHub Security Advisory GHSA-6pfc-w86r-54q6.

Workarounds

No official workarounds exist per the vendor advisory; upgrading to 2.26.0 is required
As a compensating control, place GeoServer behind an authenticating reverse proxy that blocks anonymous access to /web/ paths
Strip version-identifying strings from HTTP responses at a web application firewall (WAF) if patching is delayed

bash

# Example nginx rule to block unauthenticated access to GeoServer web console
location /geoserver/web/ {
    auth_basic "GeoServer Admin";
    auth_basic_user_file /etc/nginx/.htpasswd;
    proxy_pass http://geoserver_backend;
}