PT-2025-24663 · Geoserver · Geoserver

Published 2025-06-10 · Updated 2025-06-10 · CVE-2024-40625

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.26.0

Description The issue concerns the Coverage REST API, specifically the endpoint "/workspaces/{workspaceName}/coveragestores/{storeName}/{method}.{format}", which allows attackers to upload files with a specified URL when the {method} equals 'url' without any restrictions. This vulnerability presents an opportunity for Server Side Request Forgery. The API endpoint does not properly check the provided URL, which should be validated using the URL Checks feature.

Recommendations For versions prior to 2.26.0, update to version 2.26.0 or later to resolve the issue. As a temporary workaround, consider adding URL checks, such as using URLCheckers.confirm(fileURL), to validate the file URL before uploading. Restrict access to the vulnerable API endpoint until the update is applied.

Exploit

Fix

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

BDU:2025-10401

CVE-2024-40625

GHSA-R4HF-R8GJ-JGW2

Affected Products

Geoserver

References · 10

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/40xxx/CVE-2024-40625.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-40625 · Security Note
• https://osgeo-org.atlassian.net/browse/GEOS-11468 · Patch
• https://bdu.fstec.ru/vul/2025-10401 · Security Note
• https://osv.dev/vulnerability/GHSA-r4hf-r8gj-jgw2 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-40625 · Vendor Advisory
• https://github.com/geoserver/geoserver · Note
• https://github.com/geoserver/geoserver/security/advisories/GHSA-r4hf-r8gj-jgw2 · Note
• https://twitter.com/CVEnew/status/1932451299347337224 · Twitter Post
• https://osgeo-org.atlassian.net/browse/GEOS-11717 · Note