| Package | Affected versions | Patched versions |
|---|---|---|
| org.geoserver.web:gs-web-app | ≥ 2.26.0, < 2.26.3< 2.25.6 | 2.26.32.25.6 |
| org.geoserver:gs-rest | ≥ 2.26.0, < 2.26.3< 2.25.6 | 2.26.32.25.6 |
| geoserver | ≥ 2.26.0, < 2.26.3< 2.25.6 | 2.26.32.25.6 |
It is possible to bypass the default REST API security and access the index page.
The REST API security handles rest and its subpaths but not rest with an extension (e.g., rest.html).
The REST API index can disclose whether certain extensions are installed.
In ${GEOSERVER_DATA_DIR}/security/config.xml, change the paths for the rest filter to /rest.*,/rest/** and change the paths for the gwc filter to /gwc/rest.*,/gwc/rest/** and restart GeoServer.
https://osgeo-org.atlassian.net/browse/GEOS-11664
https://osgeo-org.atlassian.net/browse/GEOS-11776
https://github.com/geoserver/geoserver/pull/8170
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free