OSGeo GeoServer XXE Injection Exploitation Attempt

union CommonSecurityLog, W3CIIISLog, AzureDiagnostics
| where TimeGenerated > ago(24h)
| where RequestURL has_any ("/geoserver/wfs", "/geoserver/wcs", "/geoserver/wms", "/geoserver/ows")
| where RequestMethod in ("POST", "PUT")
| where RequestBody has_any ("<!ENTITY", "SYSTEM", "<!DOCTYPE", "file://", "http://", "https://", "ftp://")
    or RequestURL has_any ("xxe", "entity", "DOCTYPE")
| extend XXEIndicators = dynamic(["<!ENTITY", "SYSTEM ", "<!DOCTYPE", "PUBLIC "])
| extend MatchedIndicators = array_length(set_intersect(todynamic(split(RequestBody, " ")), XXEIndicators))
| project TimeGenerated, RequestURL, RequestMethod, RequestBody, SourceIP, DestinationIP, Computer, MatchedIndicators
| order by TimeGenerated desc

index=web OR index=proxy OR index=waf sourcetype IN ("access_combined", "iis", "nginx:access", "apache:access", "pan:traffic", "waf")
| where match(uri_path, "(?i)/geoserver/(wfs|wcs|wms|ows|web)")
| where method IN ("POST", "PUT")
| where match(request_body, "(?i)(<!ENTITY|SYSTEM\s+[\"']|<!DOCTYPE|file://|jar://|netdoc://)")
    OR match(uri_query, "(?i)(ENTITY|DOCTYPE|SYSTEM)")
| eval xxe_score=0
| eval xxe_score=xxe_score + if(match(request_body, "(?i)<!ENTITY"), 3, 0)
| eval xxe_score=xxe_score + if(match(request_body, "(?i)SYSTEM"), 2, 0)
| eval xxe_score=xxe_score + if(match(request_body, "(?i)<!DOCTYPE"), 2, 0)
| eval xxe_score=xxe_score + if(match(request_body, "(?i)file://"), 3, 0)
| eval xxe_score=xxe_score + if(match(request_body, "(?i)(jar://|netdoc://|gopher://|dict://)"), 4, 0)
| where xxe_score >= 3
| stats count, max(xxe_score) as max_score, values(uri_path) as endpoints, values(src_ip) as source_ips, earliest(_time) as first_seen, latest(_time) as last_seen by dest_ip, src_ip
| sort -max_score

sequence by source.ip with maxspan=5m
  [network where network.protocol == "http"
    and http.request.method in ("POST", "PUT")
    and url.path : ("*/geoserver/wfs*", "*/geoserver/wcs*", "*/geoserver/wms*", "*/geoserver/ows*")
    and (
      http.request.body.content : ("*<!ENTITY*", "*SYSTEM *", "*<!DOCTYPE*", "*file://*", "*jar://*", "*netdoc://*")
      or http.request.body.bytes > 512
    )
  ]
  [network where network.direction == "egress"
    and destination.port in (80, 443, 53, 389, 636)
    and not destination.ip : ("10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16")
  ]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  destinationip,
  destinationport,
  URL,
  QIDNAME(qid) AS event_name,
  username,
  "HTTP Method" AS http_method,
  "Post Data" AS post_data,
  magnitude
FROM events
WHERE
  LOWER(URL) MATCHES '.*\/geoserver\/(wfs|wcs|wms|ows|web).*'
  AND "HTTP Method" IN ('POST', 'PUT')
  AND (
    LOWER("Post Data") MATCHES '.*(<!entity|system\s+["\']|<!doctype|file:\/\/|jar:\/\/|netdoc:\/\/).*'
    OR LOWER(URL) MATCHES '.*(entity|doctype|system).*'
  )
  AND LOGSOURCETYPENAME(logsourceid) IN ('Apache HTTP Server', 'Microsoft IIS', 'Nginx', 'F5 BIG-IP LTM')
ORDER BY starttime DESC
LAST 24 HOURS

_sourceCategory=web/* OR _sourceCategory=proxy/* OR _sourceCategory=waf/*
| where %"cs-method" in ("POST", "PUT") or method in ("POST", "PUT")
| where matches(%"cs-uri-stem", "*/geoserver/*") or matches(url, "*/geoserver/*")
| where matches(%"cs-uri-stem", "*/(wfs|wcs|wms|ows|web)*") or matches(url, "*/(wfs|wcs|wms|ows|web)*")
| where matches(request_body, "*<!ENTITY*") or matches(request_body, "*SYSTEM *") or matches(request_body, "*<!DOCTYPE*") or matches(request_body, "*file://*") or matches(request_body, "*jar://*") or matches(request_body, "*netdoc://*")
| count by src_ip, url, request_body
| where _count > 0
| sort by _count desc
| limit 100

rule geoserver_xxe_injection_cve_2025_58360 {
  meta:
    author = "df00tech"
    description = "Detects XXE injection attempts against OSGeo GeoServer endpoints (CVE-2025-58360)"
    severity = "CRITICAL"
    priority = "HIGH"
    reference = "https://github.com/geoserver/geoserver/security/advisories/GHSA-fjf5-xgmq-5525"
    mitre_attack = "T1190, T1083, T1048"

  events:
    $http.metadata.event_type = "NETWORK_HTTP"
    $http.network.http.method = /POST|PUT/
    $http.network.http.url = /\/geoserver\/(wfs|wcs|wms|ows|web)/
    (
      $http.network.http.request_body = /<!ENTITY/
      or $http.network.http.request_body = /SYSTEM\s+["']/
      or $http.network.http.request_body = /<!DOCTYPE/
      or $http.network.http.request_body = /file:\/\//
      or $http.network.http.request_body = /jar:\/\//
      or $http.network.http.request_body = /netdoc:\/\//
      or $http.network.http.request_body = /gopher:\/\//
    )

  condition:
    $http
}

#event_simpleName=NetworkReceiveAccept OR #event_simpleName=HttpRequest
| ImageFileName = /(?i)(geoserver|java)/
| RemotePort in (8080, 8443, 80, 443)
| HttpMethod in ("POST", "PUT")
| HttpUrl = /\/geoserver\/(wfs|wcs|wms|ows|web)/i
| HttpRequestBody = /(<!ENTITY|SYSTEM\s+[\'"]{1}|<!DOCTYPE|file:\/\/|jar:\/\/|netdoc:\/\/|gopher:\/\/)/i
| groupby([ComputerName, UserName, RemoteAddressIP4, HttpUrl, HttpMethod], function=[count(aid, as=request_count), collect(HttpRequestBody, limit=5)])
| sort(request_count, order=desc)