GeoServer - Missing Authorization on REST API Index

mediumseverity

5.3CVSS score

1.2%likelihood of exploitation, next 30 days

69%of all CVEs are less likely

Readycheck to confirm it

GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.

Impact

Unauthenticated users can access the GeoServer REST API Index page, potentially exposing sensitive configuration information and available API endpoints.

Fix

Upgrade to the latest GeoServer version that implements proper authorization checks for the REST API Index page.

How to confirm it

Send: GET {{BaseURL}}/rest.html ; GET {{BaseURL}}/geoserver/rest.html
Positive when: contains "Geoserver Configuration API" AND contains "about/status" AND status 200

Run it with nuclei: nuclei -id CVE-2025-27505 -u <target>

The full check

id: CVE-2025-27505

info:
  name: GeoServer - Missing Authorization on REST API Index
  author: securitytaters
  severity: medium
  description: |
    GeoServer contains a missing authorization vulnerability that allows unauthorized access to the REST API Index page, potentially exposing sensitive configuration information.
  impact: |
    Unauthenticated users can access the GeoServer REST API Index page, potentially exposing sensitive configuration information and available API endpoints.
  remediation: |
    Upgrade to the latest GeoServer version that implements proper authorization checks for the REST API Index page.
  reference:
    - http://geoserver.org/
    - https://geoserver.org/vulnerability/2025/06/10/cve-disclosure.html
    - https://nvd.nist.gov/vuln/detail/CVE-2025-27505
  classification:
    epss-score: 0.01222
    epss-percentile: 0.68974
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2025-27505
    cwe-id: CWE-862
    cpe: cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 2
    fofa-query: app="geoserver"
    shodan-query: http.title:"geoserver"
    vendor: osgeo
    product: geoserver
  tags: cve,cve2025,geoserver,misconfig,osgeo,vkev,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/rest.html"
      - "{{BaseURL}}/geoserver/rest.html"

    stop-at-first-match: true

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Geoserver Configuration API"

      - type: word
        part: body
        words:
          - "about/status"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from