CVE-2025-21621: 
Java vulnerability analysis and mitigation

CVE-2025-21621 is a Reflected Cross-Site Scripting (XSS) vulnerability in GeoServer's WMS GetFeatureInfo HTML output format. It allows a remote, unauthenticated attacker to execute arbitrary JavaScript in a victim's browser via specially crafted SLD_BODY parameters. All GeoServer versions prior to 2.25.0 are affected (Maven packages org.geoserver.web:gs-web-app and org.geoserver:gs-wms). The vulnerability was disclosed on November 25, 2025, and carries a CVSS v3.1 base score of 6.1 (Medium) (Github Advisory, GeoServer Advisory).

The root cause (CWE-79) is that the WMS service setting controlling FreeMarker template HTML auto-escaping was either disabled by default or entirely absent in affected versions, allowing user-controlled input to be reflected unescaped into HTML output (GeoServer Advisory). An attacker crafts a WMS GetFeatureInfo request with a malicious SLD_BODY parameter containing JavaScript; when a victim clicks a specially crafted link or is otherwise directed to the URL, the server reflects the payload into the HTML response and the browser executes it. The fix, implemented in PR #7406, enables FreeMarker's HTMLOutputFormat auto-escaping by default via a new GEOSERVER_FORCE_FREEMARKER_ESCAPING system property (defaulting to true), and was merged into the main branch on February 12, 2024, shipping in GeoServer 2.25.0 (GeoServer PR #7406, Patch Commit).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the victim's browser session, enabling them to perform any action the victim can perform within GeoServer, view or exfiltrate any data accessible to the victim, modify data the victim has permission to change, and initiate further attacks (e.g., CSRF, credential harvesting) that appear to originate from the victim (GeoServer Advisory). The confidentiality and integrity impacts are rated low, and there is no direct availability impact; however, the scope is changed, meaning the vulnerability can affect resources beyond the vulnerable component itself (Github Advisory).

No public proof-of-concept exploit code is known to exist, and there is no evidence of active in-the-wild exploitation at this time (Github Advisory). The vulnerability is network-exploitable with no privileges required, but does require user interaction (a victim must follow a crafted link). The EPSS score is approximately 0.035% (11th percentile), indicating a low near-term exploitation probability. CVE-2025-21621 is not currently listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.

1. Reconnaissance: Identify internet-facing GeoServer instances running versions prior to 2.25.0 using tools like Shodan or Censys, searching for GeoServer WMS endpoints.
2. Identify vulnerable endpoint: Confirm the target exposes the WMS GetFeatureInfo service with text/html output format enabled and dynamic styling not disabled.
3. Craft malicious URL: Construct a WMS GetFeatureInfo request URL with a malicious JavaScript payload embedded in the SLD_BODY parameter, for example:

   /geoserver/wms?SERVICE=WMS&VERSION=1.1.1&REQUEST=GetFeatureInfo&...&SLD_BODY=<StyledLayerDescriptor>...<Title><script>alert(document.cookie)</script></Title>...</StyledLayerDescriptor>&INFO_FORMAT=text/html

4. Deliver to victim: Send the crafted URL to a target user via phishing email, social engineering, or embed it in a web page the victim is likely to visit.
5. Script execution: When the victim clicks the link, GeoServer reflects the unescaped SLD_BODY content into the HTML response, causing the browser to execute the injected JavaScript in the context of the GeoServer application.
6. Achieve objective: Use the executed script to steal session cookies, perform actions on behalf of the victim, or pivot to further attacks (GeoServer Advisory).

• Network: Unusual or unexpected WMS GetFeatureInfo requests containing SLD_BODY parameters with HTML/JavaScript content (e.g., <script>, javascript:, onerror=, onload=) in server access logs.
• Logs: GeoServer access logs showing GetFeatureInfo requests with INFO_FORMAT=text/html and abnormally large or encoded SLD_BODY values; URL-encoded variants of <script> tags (%3Cscript%3E) in request parameters.
• Network: Outbound connections from victim browsers to attacker-controlled infrastructure shortly after accessing GeoServer WMS endpoints, potentially indicating data exfiltration or C2 beacon activity.

Upgrade GeoServer to version 2.25.0 or later, which enables FreeMarker HTML auto-escaping by default via the GEOSERVER_FORCE_FREEMARKER_ESCAPING system property (GeoServer Advisory, GeoServer PR #7406). For deployments that cannot immediately upgrade, any of the following WMS service configuration changes will mitigate the vulnerability in most environments:

• Enable GetFeatureInfo HTML auto-escaping (available in GeoServer 2.21.3+ and 2.22.1+)
• Disable dynamic styling
• Disable the GetFeatureInfo text/html MIME type

Additionally, deploying a Content Security Policy (CSP) header to restrict script execution can reduce the impact of any XSS exploitation.

The vulnerability was reported by researcher sikeoka and the advisory was published by GeoServer maintainer aaime on November 25, 2025 (GeoServer Advisory). The GeoServer project simultaneously released version 2.28.1 with the fix and published an announcement on their official site (GeoServer Announcement). Red Hat also tracked the vulnerability for their products (Red Hat CVE). No significant broader community controversy or media coverage has been observed beyond standard vulnerability disclosure channels.