{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/products/gs-web-app/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["gs-main","gs-wms","gs-web-app"],"_cs_severities":["high"],"_cs_tags":["vulnerability","rce","geoserver"],"_cs_type":"advisory","_cs_vendors":["GeoServer"],"content_html":"\u003cp\u003eGeoServer contains a server-side template injection (SSTI) vulnerability, tracked as CVE-2024-45747, affecting versions prior to 2.27.0. The vulnerability resides in the processing engine for FreeMarker templates used in WMS output formats, specifically GetFeatureInfo (HTML and JSON) and GetMap (KML and GeoRSS). While the internal method org.geoserver.template.TemplateUtils.getSafeConfiguration() is designed to restrict access to the freemarker.template.utility.Execute class, attackers can bypass these protections by chaining specific method calls. This flaw allows an authenticated administrator to upload malicious templates, ultimately resulting in remote code execution (RCE) and arbitrary file read/write operations on the hosting server. Defenders should note that this vulnerability requires administrative authentication, making the protection of administrative credentials and session management critical for risk mitigation.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker obtains or creates an authenticated administrative session to the target GeoServer instance.\u003c/li\u003e\n\u003cli\u003eAttacker navigates to the WMS output settings or administrative template management interface.\u003c/li\u003e\n\u003cli\u003eAttacker crafts a malicious FreeMarker template designed to chain method calls that bypass the TemplateUtils restriction.\u003c/li\u003e\n\u003cli\u003eAttacker uploads the crafted template through the administrative web interface.\u003c/li\u003e\n\u003cli\u003eAttacker triggers the WMS GetFeatureInfo or GetMap functionality to invoke the injected template processing.\u003c/li\u003e\n\u003cli\u003eThe server-side FreeMarker engine processes the template, failing to restrict access to sensitive utility classes.\u003c/li\u003e\n\u003cli\u003eMalicious code executes with the privileges of the GeoServer application process.\u003c/li\u003e\n\u003cli\u003eAttacker achieves remote code execution or unauthorized access to the filesystem.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows an authenticated attacker to gain full control over the GeoServer instance through remote code execution. Furthermore, the ability to read and write arbitrary files on the server enables the extraction of sensitive configuration data, credentials, or the modification of application logic to establish persistence. This vulnerability affects multiple core components of the GeoServer ecosystem, including gs-main, gs-wms, and gs-web-app.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eUpgrade all GeoServer deployments to version 2.27.0 or later to patch CVE-2024-45747.\u003c/li\u003e\n\u003cli\u003eConfigure the new application properties GEOSERVER_FREEMARKER_BLOCK_LIST and GEOSERVER_FREEMARKER_ALLOW_LIST to enforce strict access controls on FreeMarker template object access.\u003c/li\u003e\n\u003cli\u003eMonitor administrative logs for unauthorized or unexpected template uploads and modifications.\u003c/li\u003e\n\u003cli\u003eRestrict access to administrative interfaces to trusted management subnets to mitigate the prerequisite authentication requirement.\u003c/li\u003e\n\u003c/ol\u003e\n","date_modified":"2026-08-19T22:33:48Z","date_published":"2026-08-19T22:33:48Z","id":"https://feed.craftedsignal.io/briefs/2026-08-geoserver-ssti/","summary":"An authenticated administrator can exploit a server-side template injection (SSTI) vulnerability in GeoServer's FreeMarker engine to execute arbitrary OS commands and perform unauthorized file operations.","title":"GeoServer Server-Side Template Injection Vulnerability","url":"https://feed.craftedsignal.io/briefs/2026-08-geoserver-ssti/"}],"language":"en","title":"CraftedSignal Threat Feed - Gs-Web-App","version":"https://jsonfeed.org/version/1.1"}