Executive Summary

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a directive concerning CVE-2025-58360, a critical unauthenticated XML External Entity (XXE) injection vulnerability in OSGeo GeoServer. With a CVSS score ranging from 8.2 to 9.8, the flaw is being actively exploited in the wild. This has prompted CISA to add it to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply patches by January 1, 2026. The vulnerability allows remote, unauthenticated attackers to exfiltrate sensitive files, pivot to internal networks via Server-Side Request Forgery (SSRF), or cause a denial of service. Given GeoServer's widespread use for sharing geospatial data, all organizations utilizing this software are at significant risk and should prioritize remediation.

Vulnerability Details

• CVE-2025-58360: Unauthenticated XML External Entity (XXE) Injection
• CVSS Score: 8.2 to 9.8 (Critical)
• Attack Vector: Remote / Unauthenticated

The vulnerability exists in the /geoserver/wms endpoint during GetMap operations. GeoServer fails to properly sanitize user-supplied XML input, allowing an attacker to submit a crafted XML payload containing external entity declarations.

An attacker can exploit this flaw in several ways:

1. Arbitrary File Disclosure: By referencing local files (e.g., /etc/passwd, configuration files with credentials) in the XML payload, an attacker can exfiltrate their contents.
2. Server-Side Request Forgery (SSRF): The attacker can force the GeoServer instance to make requests to other systems on the internal network, enabling network reconnaissance and potential pivots to other vulnerable internal services.
3. Denial of Service (DoS): A malicious XML payload can trigger a 'billion laughs' attack, consuming all available server memory and causing a crash.

Affected Systems

• GeoServer versions up to 2.26.0 (Patched in 2.26.2 and newer)
• GeoServer versions up to 2.25.0 (Patched in 2.25.6 and newer)

Exploitation Status

CISA has confirmed that CVE-2025-58360 is being actively exploited in the wild. While specific details about the threat actors or their targets have not been released, the inclusion in the KEV catalog indicates observed, real-world attacks. Unauthenticated, high-impact vulnerabilities like this are prime targets for both opportunistic cybercriminals and state-sponsored actors for initial access and data theft.

• MITRE ATT&CK Mapping:
  • T1190 - Exploit Public-Facing Application: The primary technique used to gain initial access.
  • T1530 - Data from Local System: The XXE vulnerability is used to read and collect local files.
  • T1599 - Compromise Infrastructure: The SSRF capability allows attackers to probe and potentially compromise other internal systems.
  • T1499 - Endpoint Denial of Service: The DoS aspect of the vulnerability can be used to disrupt services.

Impact Assessment

Successful exploitation of this vulnerability can have severe consequences. The exfiltration of configuration files could expose database credentials, API keys, or other secrets, leading to a full system compromise. The SSRF capability transforms a public-facing server into a pivot point, bypassing perimeter defenses and allowing attackers to map and attack the internal network. For government agencies and companies that rely on GeoServer for critical mapping and location-based services, a DoS attack could disrupt essential operations. The addition to the KEV catalog signifies a clear and present danger to all unpatched systems.

Cyber Observables for Detection

Security teams can hunt for signs of exploitation by reviewing web server logs for suspicious requests.

Detection Methods

• Vulnerability Scanning: Use authenticated and unauthenticated scans to identify vulnerable GeoServer versions on your network.
• Log Analysis: Ingest GeoServer and web server logs into a SIEM. Create detection rules to alert on requests to the /geoserver/wms endpoint that contain common XXE payloads or keywords like ENTITY, SYSTEM, or PUBLIC. This aligns with D3FEND File Analysis (D3-FA) on inbound request bodies.
• Network Monitoring: Implement egress filtering on the GeoServer host and monitor for any unexpected outbound connections, especially to internal RFC1918 address space. This is a key part of D3FEND Outbound Traffic Filtering (D3-OTF).

Remediation Steps

1. Upgrade GeoServer: The most effective solution is to upgrade to a patched version immediately: GeoServer 2.26.2 or 2.25.6 or newer. This is a direct application of D3FEND Software Update (D3-SU).
2. Apply Workarounds (If Patching is Delayed): If immediate patching is not possible, consider disabling the WMS service if it is not needed. Alternatively, use a Web Application Firewall (WAF) to inspect and block requests containing malicious XML payloads targeting the vulnerable endpoint. A WAF can be configured to drop requests with <!ENTITY in the body, providing a virtual patch.
3. Review System Configuration: After patching, assume compromise. Review the GeoServer system for any unauthorized changes, check for unexpected local files or processes, and rotate all credentials and secrets stored on the server.