GeoServer EUVD-2025-210277

Requires an authenticated GeoServer account holding administrator rights over the security subsystem (PR:H), network reachability to the GeoServer web administration interface, and the web admin UI must not be disabled or stripped from the deployment. For full RCE the host must auto-execute JSPs from a directory writable by the GeoServer process - the canonical case called out by the vendor is geoserver.war dropped into a default Apache Tomcat webapps directory; the target JSP path must not already exist and all parent directories must exist. For the NTLM-leak variant GeoServer must run on Windows and the supplied path must be a UNC reachable to the attacker. Exploitation is blocked entirely on installations where the web UI is disabled or removed.

The CVSS 3.1 vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2 High) accurately reflects that the bug needs an authenticated GeoServer administrator but, once that bar is met, the attack is fully remote, scriptable, and yields full CIA impact via RCE. No EPSS score, KEV listing, or public PoC was provided, so this is not currently a mass-exploitation candidate - the real risk profile is post-compromise privilege escalation (admin → host RCE) or malicious-insider scenarios rather than internet-wide drive-by exploitation. A secondary, environment-conditional risk applies on Windows hosts where the admin can coerce GeoServer into making an outbound SMB/UNC fetch to leak the service account's NTLM hash, useful for lateral movement. The PR:H requirement materially limits widespread exploitation, but any deployment that treats the GeoServer admin role as lower-trust than the underlying OS account should treat this as critical.

A malicious or compromised GeoServer administrator logs into the web admin UI, sets the master password to a small JSP webshell payload, then visits the Master Password Dump page and supplies an absolute path such as /var/lib/tomcat/webapps/ROOT/shell.jsp; Tomcat auto-deploys the new JSP and the attacker requests it to execute OS commands as the Tomcat user. On Windows, the same primitive can target a UNC path like \\attacker.example.com\share\dump to coerce an outbound NTLM authentication and capture the service account's hash for offline cracking or relay.