Description
This module exploits an XML External Entity (XXE) vulnerability in GeoServer via the WMS GetMap operation. The vulnerability allows reading arbitrary files from the server's file system by injecting an XXE entity in the SLD (Styled Layer Descriptor).
Affected versions: - GeoServer >= 2.26.0, <= 2.26.1 - GeoServer <= 2.25.5
The file content is returned in the error message when the layer name contains the XXE entity reference.
Module options
To display the available options, load the module within the Metasploit console and run the commands 'show options' or 'show advanced':
msf > use auxiliary/gather/geoserver/wms_getmap_xxe_file_readmsf undefined(wms_getmap_xxe_file_read) > show actions ...actions...msf undefined(wms_getmap_xxe_file_read) > set ACTION < action-name >msf undefined(wms_getmap_xxe_file_read) > show options ...show and set options...msf undefined(wms_getmap_xxe_file_read) > runPrioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub