CVE-2024-36401

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.22.6 GeoServer versions prior to 2.23.6 GeoServer versions prior to 2.24.4 GeoServer versions prior to 2.25.2

Description Unauthenticated users can achieve remote code execution on default installations due to the unsafe evaluation of property names as XPath expressions. The GeoTools library API evaluates property or attribute names for feature types and passes them insecurely to the commons-jxpath library, which can execute arbitrary code. While this XPath evaluation was intended only for complex feature types (Application Schema data stores), it is incorrectly applied to simple feature types, affecting all instances. This issue is exploitable via the following OGC request endpoints: 'WFS GetFeature', 'WFS GetPropertyValue', 'WMS GetMap', 'WMS GetFeatureInfo', 'WMS GetLegendGraphic', and 'WPS Execute'.

Real-world exploitation has been observed targeting government, transportation, and industry sectors. Attackers have used this flaw to recruit servers into botnets, such as Mirai and PolarEdge, and to deploy cryptocurrency miners for Monero. In one instance, a federal agency was breached, allowing attackers to perform lateral movement and attempt to upload web shells. Approximately 1,071 of 4,606 identified instances were initially found to be vulnerable.

Recommendations Update GeoServer to version 2.22.6 or later. Update GeoServer to version 2.23.6 or later. Update GeoServer to version 2.24.4 or later. Update GeoServer to version 2.25.2 or later. As a temporary workaround, remove the gt-complex-x.y.jar file (where x.y is the GeoTools version) from the GeoServer installation to remove the vulnerable code, though this may disrupt some functionality or prevent deployment if the module is required.