GeoServer: CVE-2025-58360

An XML External Entity (XXE) vulnerability was discovered in GeoServer (opens in new tab) in late 2025 and assigned CVE-2025-58360 (opens in new tab). This flaw allows unauthenticated attackers to perform arbitrary file reads on the host server and abuse the application for Server-Side Request Forgery (SSRF). The vulnerability received a critical severity rating, with a CVSS score of 9.8, as assessed by NIST.

GeoServer is widely used by governments and private organizations to publish and manage geospatial data, making vulnerabilities in this platform particularly impactful when exposed to the internet. In this room, we will explore GeoServer and its role in real-world infrastructure, walk through exploitation using crafted XML payloads, analyze artifacts left by an attacker, and discuss detection methods.

Learning Objectives

• Understand the role of GeoServer in modern geospatial systems
• Explain how XXE vulnerabilities arise in XML parsers
• Exploit the vulnerability to retrieve sensitive system files
• Analyze web access logs and GeoServer application logs to detect exploitation activity

Room Prerequisites

Some familiarity with the Linux command line and prior exposure to XML and XXE vulnerabilities will be helpful. However, all required commands are provided in the walkthrough.

• Check out XXE Injection for an overview of XXE vulnerabilities

Lab Access

Start the lab machine by clicking the Start Lab Machine button below. To attack the target VM, use the AttackBox by clicking Start AttackBox, or connect using your own machine via VPN.

Set up your virtual environment

To successfully complete this room, you'll need to set up your virtual environment. This involves starting both your AttackBox (if you're not using your VPN) and Target Machines, ensuring you're equipped with the necessary tools and access to tackle the challenges ahead.

Attacker machine

Status:Off

Lab machine

Status:Off

Start Lab Machine