Back to KEVs

CVE-2021-40822

GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.

Basic Information

CVE State
PUBLISHED
Reserved Date
September 09, 2021
Published Date
May 01, 2022
Last Updated
August 04, 2024
Vendor
n/a
Product
n/a
Description
GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows SSRF via the option for setting a proxy host.
Tags
nuclei_scanner

CVSS Scores

CVSS v3.1

7.5 - HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CVSS v2.0

5.0

Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N

EPSS Score

Score
92.06% (Percentile: 99.68%) as of 2025-05-24

Exploit Status

Exploited in the Wild
Yes (2025-05-08 00:00:00 UTC) Source

References

https://github.com/geoserver/geoserver/releases https://osgeo-org.atlassian.net/browse/GEOS-10229 https://github.com/geoserver/geoserver/compare/2.19.2...2.19.3 https://osgeo-org.atlassian.net/browse/GEOS-10229?focusedCommentId=83508

Known Exploited Vulnerability Information

Source Added Date
The Shadowserver (via CIRCL) 2025-04-26 00:00:00 UTC

Recent Mentions

[org.geoserver:gs-wfs] GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

Source: Github Advisory Database (Maven) • Published: 2025-06-10 14:13:25 UTC

Summary It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Details A unauthenticated user can supply a request that will be issued by the server. This can be used to enumerate internal networks and also in the case of cloud instances can be used to obtain sensitive data. Mitigation When using GeoServer with a proxy, manage the proxy base value as a system administrator, use the application property PROXY_BASE_URL to provide a non-empty value that cannot be overridden by the user interface or incoming request. When using GeoServer directly without a proxy, block all access to TestWfsPost by editing the web.xml file. Adding this block right before the end: BlockDemoRequests /TestWfsPost/* BLOCKED Resolution Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue. The demo request page functionality is now implemented directly in the browser. Reference https://osgeo-org.atlassian.net/browse/GEOS-11794 https://osgeo-org.atlassian.net/browse/GEOS-11390 https://nvd.nist.gov/vuln/detail/CVE-2021-40822 References https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw https://nvd.nist.gov/vuln/detail/CVE-2021-40822 https://osgeo-org.atlassian.net/browse/GEOS-11390 https://osgeo-org.atlassian.net/browse/GEOS-11794 https://github.com/advisories/GHSA-5gw5-jccf-6hxw

[org.geoserver.web:gs-app] GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

Source: Github Advisory Database (Maven) • Published: 2025-06-10 14:13:25 UTC

Summary It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Details A unauthenticated user can supply a request that will be issued by the server. This can be used to enumerate internal networks and also in the case of cloud instances can be used to obtain sensitive data. Mitigation When using GeoServer with a proxy, manage the proxy base value as a system administrator, use the application property PROXY_BASE_URL to provide a non-empty value that cannot be overridden by the user interface or incoming request. When using GeoServer directly without a proxy, block all access to TestWfsPost by editing the web.xml file. Adding this block right before the end: BlockDemoRequests /TestWfsPost/* BLOCKED Resolution Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue. The demo request page functionality is now implemented directly in the browser. Reference https://osgeo-org.atlassian.net/browse/GEOS-11794 https://osgeo-org.atlassian.net/browse/GEOS-11390 https://nvd.nist.gov/vuln/detail/CVE-2021-40822 References https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw https://nvd.nist.gov/vuln/detail/CVE-2021-40822 https://osgeo-org.atlassian.net/browse/GEOS-11390 https://osgeo-org.atlassian.net/browse/GEOS-11794 https://github.com/advisories/GHSA-5gw5-jccf-6hxw

Scanner Integrations

Scanner URL Date Detected
Nuclei https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-40822.yaml 2025-04-26 00:00:00 UTC

Potential Proof of Concepts

Warning: These PoCs have not been tested and could contain malware. Use at your own risk.

phor3nsic/CVE-2021-40822

Type: github • Created: 2022-05-17 13:58:11 UTC • Stars: 2

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Detected by Nuclei

  • Added to KEVIntel