Geoserver CVE-2024-29198

This vulnerability presents genuine high risk despite the 7.5 CVSS score. The attack vector is Network with no authentication required (PR:N, UI:N), indicating broad exploitability. Attack complexity is Low, meaning exploitation does not require special conditions. The confidentiality impact is High (C:H) but integrity and availability are None, limiting direct data exfiltration but enabling reconnaissance and lateral movement attacks. The SSRF vector is particularly dangerous in cloud environments where SSRF can access metadata services (AWS IMDSv1, GCP metadata) to extract credentials. While the CVSS score suggests moderate impact, real-world risk is elevated because: (1) SSRF enables stepping-stone attacks into internal networks, (2) GeoServer often runs in geospatial/critical infrastructure contexts, (3) the vulnerability is pre-authentication, and (4) the presence of specific patched versions (2.24.4, 2.25.2) suggests active exploitation awareness. Organizations using unpatched versions with public-facing GeoServer instances face immediate compromise risk.

An attacker discovers a public-facing GeoServer instance without Proxy Base URL configured. The attacker crafts a malicious HTTP request to the Demo endpoint (e.g., GET /geoserver/web/wicket/resource/demo?url=http://169.254.169.254/latest/meta-data/) targeting AWS EC2 instance metadata. The GeoServer server processes this request and makes an outbound HTTP connection to the internal metadata service, returning sensitive information (IAM credentials, instance details) in the response. The attacker captures this response, extracts AWS credentials with attached IAM policies, and uses them for lateral movement into the organization's AWS environment. Alternatively, the attacker targets internal services (e.g., http://internal-database:5432) to probe for open ports and services, gathering intelligence for further attacks. No special PoC is required; standard HTTP clients and simple URL manipulation suffice due to the Low attack complexity and pre-authentication nature of the vulnerability.