CVE-2024-34711

GeoServer by default uses the PreventLocalEntityResolver class from the GeoTools library to filter malicious URIs in XML entities before their resolution. The filter is based on the regular expression (?i)(jar:file|http|vfs)[^?#;]*\.xsd, which is not sufficiently restrictive. An attacker can craft a URI that matches the regex pattern but points to any HTTP server or specific files, thereby bypassing the protection. Subsequently, through GET requests sent as part of XML entity resolution, it is possible to gather information about the internal network (SSRF).

An attacker can scan internal networks, obtain information about available network resources, and potentially read limited files, which may lead to further escalation of attacks on internal infrastructure.

GeoServer should be updated to version 2.25.0 or newer, which by default enforces the ENTITY_RESOLUTION_ALLOWLIST mechanism without the need for manual configuration of system parameters. In older versions, you must manually configure the system property according to the vendor's documentation available at https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities

GeoServer in versions older than 2.25.0; versions 2.25.0 and newer apply the ENTITY_RESOLUTION_ALLOWLIST mechanism by default, which limits this threat