If you think XML External Entity (XXE) vulnerabilities are a relic of the past or just theoretical noise, this walkthrough on the GeoServer CVE-2025-58360 is the wake-up call you need.

We are talking about a critical, unauthenticated vulnerability in the GetMap operation that allows literally anyone to read sensitive files from your server or pivot into your internal network via SSRF.

The core of the issue, as highlighted in the walkthrough, lies in how GeoServer’s WMS (Web Map Service) endpoint processes XML data.

While GetMap requests are typically seen as harmless GET requests, the guide demonstrates that the server also accepts them via POST with an XML body.

This is where the magic happens: by intercepting a standard request and injecting a simple <!DOCTYPE> declaration defining an external entity (like file:///etc/passwd), an attacker can trick the weakly configured XML parser into fetching and displaying the contents of that file in the error response.

You see the transition from a standard map request to a weaponized XML packet.

The walkthrough details how to identify the vulnerable versions (specifically targeting versions prior to 2.25.6 and the 2.26.x series) and demonstrates the immediate gratification of seeing the /etc/passwd file dump.

It serves as a stark reminder that even mature, widely-used open-source projects can harbor massive security gaps in their default configurations.

Ultimately, this is a critical lesson in input validation and parser configuration.

If you are running GeoServer in production and haven't patched or implemented strict WAF rules to block XML entity declarations, you are sitting on a ticking time bomb.

Enumeration Methodology

The standard directory-busting approach is functionally useless here because the endpoint /geoserver/wms is likely already known or easily discovered. The elite methodology requires a Method Swapping audit.

When you encounter a RESTful or SOAP-like endpoint that behaves normally with GET requests, your immediate instinct must be to test its behavior with POST. You are looking for the Content-Type disparity.

In this specific case, you interact with the GetMap operation. Standard enumeration involves capturing a legitimate GET request for a map layer (like trymapme_offices) and converting it into its XML equivalent.

You aren't just looking for a 200 OK; you are probing the parser.

You send a minimal XML structure to see if the server accepts it. If it does, you inject a benign DTD (like defining an entity &test; with the value "hello") to see if the server resolves it. If "hello" appears in the error message or the rendered map label, you have confirmed the parser is vulnerable.

Read the full walkthrough and exploit guide here: https://motasem-notes.net/geoserver-cve-2025-58360-tryhackme-walkthrough/