Geoserver EUVD-2025-17669

This vulnerability presents a critical real-world risk based on multiple reinforcing signals: (1) CVSS 9.3 with AV:N/AC:L/PR:N indicates network-accessible exploitation requiring no authentication or user interaction—the most severe attack surface; (2) the vulnerability enables information disclosure with high confidence (C:H) and limited integrity impact (I:L), affecting CIA triad; (3) the nature of XXE vulnerabilities, combined with GeoServer's widespread use in geospatial infrastructure (government, utilities, environmental monitoring), suggests high organizational impact; (4) the bypass technique is deterministic and does not depend on exotic conditions, making exploitation highly automatable. While EPSS scoring is not provided in the CVE data, the combination of trivial exploitation (AC:L), no privilege requirement, and network accessibility strongly suggests EPSS well above 90th percentile. This is not a theoretical high-CVSS issue—it is a practical, immediately exploitable vulnerability suitable for widespread scanning and targeted attacks. Organizations should prioritize patching immediately. KEV status and POC availability have not been indicated in the provided data but should be verified against CISA KEV database and public exploit repositories given the vulnerability's severity and the time since disclosure.

An unauthenticated attacker on the public internet targets an organization's GeoServer instance (AV:N). The attacker crafts a malicious XML document containing DOCTYPE declarations with XXE payloads designed to bypass the weak regex filter—for example, using a URI like 'http://internal-ip:8080/admin?file=config.xsd' or 'http://169.254.169.254/latest/meta-data' (AWS metadata) to extract sensitive information. The attacker submits this via GeoServer's WFS (Web Feature Service) GetPropertyValue request, POST upload, or style upload endpoints (AC:L, no authentication required). GeoServer's XML parser attempts to resolve the entity, bypassing the inadequate PreventLocalEntityResolver validation due to the regex flaw. The attacker receives the response containing internal system information (configuration files, credentials, internal IP ranges, AWS metadata), enabling reconnaissance of the internal network topology and systems. This intelligence is then leveraged for lateral movement, credential harvesting, or targeted exploitation of discovered internal services. The entire attack can be automated with standard XXE exploitation tools and executed at scale against multiple targets.