GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx
Summary
Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint.
Mitigation
To manage the proxy base value as a system administrator, use the parameter PROXY_BASE_URL to provide a non-empty value that cannot be overridden by the user interface or incoming request.thomsmith.
Resolution
The TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript Demo Requests page to test OGC Web Services.
References
- CVE-2024-29198 Unauthenticated SSRF via TestWfsPost
Affected software
Click a technology to see all vulnerabilities affecting it.
| Platform | Package | Vulnerable versions | Fixed in |
|---|---|---|---|
| Java / Kotlin (Maven) | org.geoserver:gs-wfs | >= 1.0.0, < 2.24.4, >= 2.25.0, < 2.25.2 | 2.24.4, 2.25.2 |
References
- CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N- Weakness (CWE)
CWE-918- Platform
- Java / Kotlin (Maven)
- Package
org.geoserver:gs-wfs- Disclosed
- 10.06.2025
- Updated
- 11.10.2026 12:21
Sources and licenses
OSV / GitHub Advisory Database - GHSA-68cf-j696-wvv9 - CC BY 4.0
Vulnerability history: org.geoserver:gs-wfs
All published vulnerabilities of this package (Java / Kotlin (Maven)), newest first. Shows whether this is a one-off slip or a package that needs watching.
- Total entries
- 5
- First → latest
- 06.2023 06.2025
- Without a fix
- 0
- Exploited in attacks
- 1
Severity breakdown
- Critical 2
- High 3
Disclosures per year
- 2023: 1
- 2024: 1
- 2025: 3
- 2026: 0
-
GeoServer vulnerable to SSRF in TestWfsPost for specific targets, e.g. PHP + Nginx this entry
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.