漏洞描述
GeoServer 是一款开源的 Java 服务器软件，用于共享、处理和编辑地理空间数据。CVE-2025-27505 是 GeoServer REST API 中的一个安全绕过漏洞，该漏洞源于 REST API 索引缺少授权验证，导致未经授权的用户可以访问 “/geoserver/rest.html”，进而可能获取敏感信息或进行恶意操作。
GeoServer REST API /geoserver/rest.html 未授权访问漏洞 （CVE-2025-27505）
PoC代码
暂无相关漏洞推荐
- POC CVE-2021-40822: Geoserver - Server-Side Request Forgery
- POC CVE-2022-24816: GeoServer <1.2.2 - Remote Code Execution
- POC CVE-2023-25157: GeoServer OGC Filter - SQL Injection
- POC CVE-2023-43795: GeoServer WPS - Server Side Request Forgery
- POC CVE-2024-29198: GeoServer Demo Request Endpoint - Server Side Request Forgery
- POC CVE-2024-36401: GeoServer RCE in Evaluating Property Name Expressions
- POC CVE-2024-36404: GeoServer and GeoTools - Remote Code Execution
- POC CVE-2025-27505: GeoServer - Missing Authorization on REST API Index
- POC CVE-2025-30220: GeoServer WFS - XXE Processing Vulnerability
- POC CVE-2021-40822: Geoserver - Server-Side Request Forgery
- POC CVE-2022-24816: GeoServer <1.2.2 - Remote Code Execution
- POC CVE-2023-25157: GeoServer OGC Filter - SQL Injection
- POC CVE-2024-36401: GeoServer wfs 远程代码执行漏洞