| Package | Affected versions | Patched versions |
|---|---|---|
| org.geoserver:gs-wfs | ≥ 1.0.0, < 2.24.4≥ 2.25.0, < 2.25.2 | 2.24.42.25.2 |
Missing checks allow for SSRF to specific targets using the TestWfsPost enpoint.
To manage the proxy base value as a system administrator, use the parameter PROXY_BASE_URL to provide a non-empty value that cannot be overridden by the user interface or incoming request.thomsmith.
The TestWfsPost has been replaced in GeoServer 2.25.2 and GeoServer 2.24.4 with a JavaScript Demo Requests page to test OGC Web Services.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free