CVE-2025-27511: GeoServer DB2 DataStore Extension has a JNDI Vulnerability via Store Connection
Summary
Administrator can perform JNDI attack through specially crafted DB2 jdbc url leading to Remote Code Execution (RCE).
Impact
If GeoServer has DB2 extension installed, this vulnerability can lead to executing arbitrary code.
Details
Authenticated users can access Vector Data Sources page to creating a new data store through db2 jdbc connection, performing JNDI attack due to unrestricted connection parameters, and then achieve RCE with deserialization of untrusted data.
Remediation
This issue has been fixed in this release: https://github.com/geoserver/geoserver/releases/tag/2.27.0.
References
https://osgeo-org.atlassian.net/browse/GEOT-7725 https://nvd.nist.gov/vuln/detail/cve-2023-27867
Other sources
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to version 2.27.0 of the GeoServer DB2 DataStore Extension, an administrator can perform a JNDI attack through specially crafted DB2 jdbc url leading to to Remote Code Execution (RCE). Version 2.27.0 fixes the issue.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.geoserver.extension:gs-db2to a version that resolves this vulnerability.Fixed in 2.27.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-27511?
The severity of CVE-2025-27511 is high with a score of 7.2.
What vulnerability does CVE-2025-27511 exploit?
CVE-2025-27511 exploits a JNDI attack through specially crafted DB2 JDBC URLs.
How can CVE-2025-27511 lead to a Remote Code Execution (RCE)?
CVE-2025-27511 allows authenticated users to execute arbitrary code if the DB2 extension is installed on GeoServer.
How do I fix CVE-2025-27511?
To fix CVE-2025-27511, ensure that the DB2 extension is properly configured and restrict access to the affected components.
What should I do if I suspect a CVE-2025-27511 exploit has occurred?
If you suspect an exploit of CVE-2025-27511 has occurred, immediately assess your system for any unauthorized changes or access and report the incident.