GeoNetwork Pre-Authentication Remote Code Execution

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://ethiack.com/info-hub/research/geonetwork-preauth-RCE
• Blog Title: GeoNetwork: Pre-Authentication Remote Code Execution
• Suggested Section: Network Services Pentesting > 80,443 - Pentesting Web Methodology > GeoNetwork, with cross-references from Pentesting Web > XSLT Server Side Injection, SSRF, and File Upload

🎯 Content Summary

Overview

The research documents four pre-authentication vulnerabilities in GeoNetwork, an open-source Java/Spring geospatial metadata catalog and OSGeo project widely deployed in government, environmental, research, and enterprise GIS infrastructure:

• CVE-2026-63219: unauthenticated formatter upload caused by missing authorization.
• CVE-2026-58400: operating-system command execution through unsafe Saxon-B XSLT processing.
• 🔧 Technical Details

  Audit method-level authorization independently: In Spring applications using @PreAuthorize, do not assume that an administrative controller is protected as a unit. Compare the annotations on every endpoint, especially create, upload, import, and file-writing methods. A single method missing @PreAuthorize("hasAuthority('UserAdmin')") can provide anonymous access even when adjacent list, update, download, and delete operations are protected. Determine whether created files are later parsed, compiled, included, or executed, as this can elevate broken access control into RCE.

  Turn writable XSLT into code execution through extension functions: XSLT must be treated as executable code when the processor supports language or platform extensions. If Saxon's ALLOW_EXTERNAL_FUNCTIONS remains enabled, attacker-controlled stylesheets can invoke Java functionality, including process-execution APIs. Exploitation consist...

  🤖 Agent Actions

  Implemented the HackTricks update.

  Changes

  • Added src/network-services-pentesting/pentesting-web/geonetwork.md covering:
    • Missing Spring method authorization.
    • Formatter upload chained with unsafe Saxon XSLT execution.
    • SLD tool SSRF.
    • JavaScript comma-operator reflected XSS.
    • Affected versions and technical remediation.
  • Added GeoNetwork to SUMMARY.md and the web technology index.
  • Added cross-references from the XSLT injection, SSRF, and file-upload pages.
  • Included numbered inline citations and primary/vendor references.

  Validation

  • git diff --check passed.
  • All new internal links and cross-reference paths resolve.
  • Reference numbering and forbidden-source checks passed.
  • mdbook build was not run because mdbook is not installed.

  ---

  This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://ethiack.com/info-hub/research/geonetwork-preauth-RCE

Content Categories: Based on the analysis, this content was categorized under "Network Services Pentesting > 80,443 - Pentesting Web Methodology > GeoNetwork, with cross-references from Pentesting Web > XSLT Server Side Injection, SSRF, and File Upload".

Repository Maintenance:

• MD Files Formatting: 999 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0