[XBOW-025-068] Vulnerabilidad de Procesamiento de Entidad Externa XML (XXE) en el Servicio WFS de GeoServer

Successful exploitation of CVE-2025-30220 can lead to significant data exposure and unauthorized access. Attackers can leverage the XXE injection to perform Out-of-Band (OOB) data exfiltration, potentially revealing sensitive local files accessible by the GeoServer process. Furthermore, this vulnerability enables Service Side Request Forgery (SSRF), allowing attackers to make requests to internal resources on behalf of the GeoServer, potentially compromising other systems within the network. The ability to read local files and perform SSRF significantly expands the attack surface and potential impact.

Organizations utilizing GeoServer for geospatial data serving, particularly those with publicly accessible WFS endpoints, are at risk. Environments with legacy GeoServer configurations or those lacking robust network segmentation are especially vulnerable. Shared hosting environments where multiple users share the same GeoServer instance also face increased risk.

• linux / server:

journalctl -u geoserver -g "XML External Entity"

• java / supply-chain: Inspect GeoServer configuration files for any custom XML parsing configurations that might bypass entity resolution restrictions. • generic web: Use curl to test WFS endpoints with specially crafted XML payloads containing external entity references. Monitor response headers for signs of OOB data exfiltration (e.g., DNS requests to unexpected domains).

1. 2025-06-10Disclosure

   disclosure

2. 2025-06-10CISA KEV

   added to KEV

1. Reservado2025-03-18
2. Publicada2025-06-10
3. Modificada2026-02-04
4. EPSS actualizado2026-03-23

The primary mitigation for CVE-2025-30220 is to upgrade GeoServer to version 2.27.1 or later, which includes the fix for this vulnerability. If immediate upgrading is not possible, consider implementing temporary workarounds. Restrict network access to the GeoServer instance to limit the potential impact of SSRF attacks. Review and strengthen XML parsing configurations, ensuring that entity resolution is properly restricted and that any allowlists are strictly enforced. Monitor GeoServer logs for suspicious activity related to XML parsing and external entity resolution.