CVE-2024-34711: Osgeo Geoserver server-side request forgery (SSRF) (CVSS 9.3)

Description

GeoServer is an open source server that allows users to share and edit geospatial data. An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP server. By default, GeoServer use PreventLocalEntityResolver class from GeoTools to filter out malicious URIs in XML entities before resolving them. The URI must match the regex (?i)(jar:file|http|vfs)[^?#;]*\\.xsd. But the regex leaves a chance for attackers to request to any HTTP server or limited file. Attacker can abuse this to scan internal networks and gain information about them then exploit further. GeoServer 2.25.0 and greater default to the use of ENTITY_RESOLUTION_ALLOWLIST and does not require you to provide a system property.

CVSS 3.1 breakdown

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionNone

ScopeChanged

ConfidentialityHigh

IntegrityLow

AvailabilityNone

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Affected products

Osgeo Geoserver< 2.25.0

Remediation

Fixed in

Osgeo Geoserver≥ 2.25.0

References

https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entitiesProduct
https://github.com/geoserver/geoserver/security/advisories/GHSA-mc43-4fqr-c965MitigationThird Party Advisory

Related CVEs

Recent high-severity vulnerabilities sharing a weakness type.

Frequently asked

Is CVE-2024-34711 being actively exploited?

CVE-2024-34711 is not in the CISA KEV catalog. Its EPSS exploit probability is 0.30%.

How severe is CVE-2024-34711?

CVE-2024-34711 has a CVSS 3.1 base score of 9.3, rated critical. EPSS estimates a 0.30% probability of exploitation.

Which products are affected by CVE-2024-34711?

Affected products include Osgeo Geoserver.

How do I fix CVE-2024-34711?

Upgrade affected software to a fixed version, for example Osgeo Geoserver 2.25.0 or later, then confirm no affected versions remain in your inventory.

How Secuno handles this

Secuno correlates vulnerabilities like CVE-2024-34711 against the real software inventory on every managed device, every day. Rather than a static severity, each match is scored in context: exploit availability, EPSS, the asset's exposure, and business criticality decide where it lands in the queue. If an affected version is present anywhere across your portfolio, it surfaces automatically with a prioritised remediation path.

See how prioritisation works Book a demo