# CVE-2024-29198: GeoServer Vulnerable to Unauthenticated SSRF via TestWfsPost

- Exploited (CISA KEV): no
- Published: 2025-06-10
- CVSS: 7.5 HIGH (v3.1)
- EPSS: 2.3% (83th percentile)
- CWE: CWE-918

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. It possible to achieve Service Side Request Forgery (SSRF) via the Demo request endpoint if Proxy Base URL has not been set. Upgrading to GeoServer 2.24.4, or 2.25.2, removes the TestWfsPost servlet resolving this issue.

## Edge WAF coverage (claimed by vendors, not measured)

| Vendor | Status | First rule | Days after publication |
|---|---|---|---|
| Cloudflare | Blocks by default | 2025-08-11 | 62 |
| AWS | No public claim | — | — |
| Microsoft Azure | No public claim | — | — |
| Google Cloud | No public claim | — | — |
| Fastly | Before feed history | — | — |
| F5 | No public claim | — | — |
| Akamai | No public source | — | — |
| OWASP CRS | No public claim | — | — |

### Cloudflare

- 2025-08-11 · new · rule ec6480c81253494b947d891e51bc8df1 · default Block
  > GeoServer - SSRF - CVE:CVE-2024-29198. Previous action: Log. New action: Block. This is a New Detection
  Source: https://developers.cloudflare.com/changelog/post/2025-08-11-waf-release/

## Our test (measured)

- OWASP Core Rule Set 4.25.0, paranoia level 1, anomaly threshold 5, default CRS settings: passed (0 of 1 requests blocked), template CVE-2024-29198, 2026-11-02
- OWASP Core Rule Set 4.25.0, paranoia level 2, anomaly threshold 5, default CRS settings: blocked (1 of 1 requests blocked), template CVE-2024-29198, 2026-11-02

"No public claim" means no vendor statement names this CVE; "Before feed history" means the CVE is older than the vendor feed. In both cases generic rules may still block it.

HTML: https://cve.vigilbase.com/cve/CVE-2024-29198 · JSON: https://cve.vigilbase.com/api/v1/cves/CVE-2024-29198