CVE-2024-34711

An improper URI validation vulnerability exists that enables an unauthorized attacker to perform XML External Entities (XEE) attack, then send GET request to any HTTP server. Attacker can abuse this to scan internal networks and gain information about them then exploit further. Moreover, attacker can read limited .xsd file on system.

Details

By default, GeoServer use PreventLocalEntityResolver class from GeoTools to filter out malicious URIs in XML entities before resolving them. The URI must match the regex (?i)(jar:file|http|vfs)[^?#;]*\\.xsd. But the regex leaves a chance for attackers to request to any HTTP server or limited file.

Mitigation

1. Define the system property ENTITY_RESOLUTION_ALLOWLIST to limit the supported external schema locaitons.
2. The built-in allow list covers the locations required for the operation of OGC web services: www.w3.org,schemas.opengis.net,www.opengis.net,inspire.ec.europa.eu/schemas.
3. The user guide provides details on how to add additional locations (this is required for app-schema plugin where a schema is supplied to define an output format).

Resolution

1. GeoServer 2.25.0 and greater default to the use of ENTITY_RESOLUTION_ALLOWLIST and does not require you to provide a system property.
2. The use of ENTITY_RESOLUTION_ALLOWLIST is still supported if you require additional schema locations to be supported beyond the built-in allow list.
3. GeoServer 2.25.1 change ENTITY_RESOLUTION_ALLOWLIST no longer supports regular expressions

References

• External Entities Resolution (GeoServer User Guide)

Credits

• Le Mau Anh Phong from VNG Security Response Center & VNUHCM - University of Information Technology

An unauthenticated attacker can:

1. Scan internal network to gain insight about it and exploit further.
2. SSRF to endpoint ends with .xsd.
3. Read limited .xsd file on system.

The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths. Typical impact: varies by context: data corruption, logic bypass, or denial of service.

CVE-2024-34711 has a CVSS score of 9.3 (Critical). The vector is network-reachable, no privileges required, and no user interaction. A CVSS score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether this affects your application depends on whether the vulnerable code is present and reachable in your environment. A fixed version is available (2.25.0); upgrading removes the vulnerable code path.

Kodem intelligence

1. What is CVE-2024-34711? CVE-2024-34711 is a critical-severity improper input validation vulnerability in org.geoserver.web:gs-web-app (maven), affecting versions < 2.25.0. It is fixed in 2.25.0. The application does not adequately validate input before processing it, allowing unexpected values to reach sensitive code paths.
2. How severe is CVE-2024-34711? CVE-2024-34711 has a CVSS score of 9.3 (Critical). This score reflects the worst-case severity of the vulnerability, not your specific exposure. Whether it represents real risk in your environment depends on whether the vulnerable code is present and reachable.
3. Which packages are affected by CVE-2024-34711?
   • org.geoserver.web:gs-web-app (maven) (versions < 2.25.0)
   • org.geoserver.main:gs-main (maven) (versions < 2.25.0)
4. Is there a fix for CVE-2024-34711? Yes. CVE-2024-34711 is fixed in 2.25.0. Upgrade to this version or later.
5. Is CVE-2024-34711 exploitable, and should I be worried? Whether CVE-2024-34711 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
6. What actually determines whether CVE-2024-34711 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
7. How do I fix CVE-2024-34711?
   • Upgrade org.geoserver.web:gs-web-app to 2.25.0 or later
   • Upgrade org.geoserver.main:gs-main to 2.25.0 or later