CVE-2025-58360: 
Java vulnerability analysis and mitigation

CVE-2025-58360 is an unauthenticated XML External Entity (XXE) injection vulnerability in OGC GeoServer's WMS GetMap operation (/geoserver/wms). The vulnerability was disclosed on November 25, 2025, and affects GeoServer versions prior to 2.25.6 and versions 2.26.0 through 2.26.1 (prior to 2.26.2). The official GitHub Security Advisory assigns a CVSS v3.1 score of 8.2 (High), while Feedly's threat intelligence estimates a score of 9.8 (Critical) based on the unauthenticated, network-exploitable nature of the flaw (Github Advisory, CISA KEV).

The root cause is CWE-611 (Improper Restriction of XML External Entity Reference): GeoServer's WMS GetMap endpoint processes XML input without adequately restricting or sanitizing external entity declarations, allowing a weakly configured XML parser to resolve attacker-controlled URIs. An attacker crafts an HTTP request to /geoserver/wms with the GetMap operation containing a malicious XML payload that defines external entities pointing to local file paths or internal network resources. No authentication, special privileges, or user interaction is required to trigger the vulnerability. The vulnerability was originally detected by the XBOW autonomous security research system and validated by a human researcher before disclosure (Github Advisory). A Metasploit auxiliary module (geoserver_wms_getmap_xxe_file_read) and multiple public PoC repositories (e.g., B1ack4sh/Blackash-CVE-2025-58360, quyenheu/CVE-2025-58360) are available (Metasploit Module).

Successful exploitation allows an unauthenticated remote attacker to read arbitrary files from the GeoServer host's file system (e.g., /etc/passwd, application configuration files containing credentials), conduct Server-Side Request Forgery (SSRF) to probe and interact with internal network services not otherwise accessible, and execute Denial of Service attacks by exhausting server resources through entity expansion. GeoServer is widely deployed in government, utilities, and enterprise environments for geospatial data sharing, meaning exploitation can expose sensitive geospatial datasets, internal infrastructure topology, and credentials stored in configuration files, with potential for lateral movement into internal networks (Github Advisory, CISA KEV).

1. Reconnaissance: Use Shodan, Censys, or FOFA to identify internet-facing GeoServer instances by searching for the /geoserver/web login page or WMS service endpoints. Filter for versions prior to 2.25.6 or 2.26.2 if version disclosure is available.
2. Confirm vulnerability: Send a benign WMS GetMap request to /geoserver/wms?SERVICE=WMS&VERSION=1.1.1&REQUEST=GetMap to confirm the endpoint is accessible and the service is running.
3. Craft malicious XML payload: Construct an HTTP POST request to /geoserver/wms with a GetMap operation body containing an XXE payload that defines an external entity referencing a target file, for example:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE foo [
  <!ENTITY xxe SYSTEM "file:///etc/passwd">
]>
<GetMap ...>&xxe;</GetMap>

4. Exfiltrate file contents: Submit the crafted request and observe the server's response, which will include the contents of the referenced file embedded in the XML output or error message.
5. Conduct SSRF: Replace the file:// URI with an http:// URI pointing to an internal service (e.g., http://169.254.169.254/latest/meta-data/ for cloud metadata) to probe internal network resources.
6. Escalate access: Use retrieved credentials (e.g., from GeoServer's web.xml, geoserver-users.xml, or OS configuration files) to authenticate to GeoServer's admin interface or other internal systems for further lateral movement.

The Metasploit module auxiliary/gather/geoserver_wms_getmap_xxe_file_read automates steps 3–4 (Metasploit Module).

• Network: Unusual HTTP POST requests to /geoserver/wms with XML bodies containing <!DOCTYPE, <!ENTITY, or SYSTEM keywords; outbound HTTP/HTTPS connections from the GeoServer process to internal IP ranges or cloud metadata endpoints (e.g., 169.254.169.254).
• Logs: GeoServer access logs showing POST requests to /geoserver/wms with abnormally large or XML-structured request bodies; repeated requests from a single IP to the WMS GetMap endpoint with varying entity definitions; Java XML parser exceptions or errors in GeoServer application logs referencing external URIs.
• File System: Unexpected access timestamps on sensitive files such as /etc/passwd, /etc/shadow, GeoServer configuration files (geoserver-users.xml, web.xml, global.xml), or private key files, indicating unauthorized reads.
• Process: Unusual outbound network connections initiated by the GeoServer Java process (e.g., java) to internal hosts or external attacker-controlled infrastructure not associated with normal GeoServer operations.

The primary remediation is to upgrade GeoServer to a patched version: 2.25.6, 2.26.2, 2.26.3, or 2.27.0 (Github Advisory). Federal agencies were required to apply mitigations by January 1, 2026, per CISA's BOD 22-01 directive (CISA KEV). If immediate patching is not possible, apply the following interim controls: (1) restrict network access to the /geoserver/wms endpoint using a WAF or firewall to trusted IP ranges only; (2) disable XML external entity processing in the Java runtime if configurable; (3) monitor for suspicious XML POST requests to the WMS endpoint. Organizations should also review GeoServer logs for evidence of prior exploitation given the active exploitation timeline beginning before the December 11, 2025 KEV listing.

CISA's addition of CVE-2025-58360 to the KEV catalog on December 11, 2025, generated significant coverage across security media, including BleepingComputer, The Hacker News, Security Affairs, and CSO Online, all highlighting the active exploitation and federal patching mandate (BleepingComputer, The Hacker News). Canada's Cyber Centre (CCCS) issued its own advisory (AV25-789) warning of the vulnerability (CCCS Advisory). The SANS Internet Storm Center discussed the vulnerability in its December 1, 2025 podcast. Security researchers on Mastodon, Bluesky, and Reddit flagged the rapid weaponization, noting the Metasploit module and multiple public PoCs as indicators of high exploitation risk. Qualys published a dedicated threat protection blog post on December 15, 2025, providing detection guidance (Qualys Blog).