CVE-2025-27505
MEDIUM5.3EPSS 0.89%GeoServer Missing Authorization on REST API Index
發布日:2025/6/10修改日:2025/6/10
描述
### Summary It is possible to bypass the default REST API security and access the index page. ### Details The REST API security handles `rest` and its subpaths but not `rest` with an extension (e.g., `rest.html`). ### Impact The REST API index can disclose whether certain extensions are installed. ### Workaround In `${GEOSERVER_DATA_DIR}/security/config.xml`, change the paths for the `rest` filter to `/rest.*,/rest/**` and change the paths for the `gwc` filter to `/gwc/rest.*,/gwc/rest/**` and restart GeoServer. ### References https://osgeo-org.atlassian.net/browse/GEOS-11664 https://osgeo-org.atlassian.net/browse/GEOS-11776 https://github.com/geoserver/geoserver/pull/8170
受影響套件(2)
- Maven/org.geoserver:gs-rest>= 2.26.0, < 2.26.3
- Maven/org.geoserver.web:gs-web-app>= 2.26.0, < 2.26.3
CVSS 分數
| 來源 | 版本 | 嚴重程度 | 向量 |
|---|---|---|---|
| osv | CVSS 3.1 | MEDIUM5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
參考連結(6)
- ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2025-27505
- PATCHhttps://github.com/geoserver/geoserver
- WEBhttps://github.com/geoserver/geoserver/pull/8170
- WEBhttps://github.com/geoserver/geoserver/security/advisories/GHSA-h86g-x8mm-78m5
- WEBhttps://osgeo-org.atlassian.net/browse/GEOS-11664
- WEBhttps://osgeo-org.atlassian.net/browse/GEOS-11776