Remote Code Execution Vulnerability in GeoServer Prior to Versions 2.23.6, 2.24.4, and 2.25.2
Key Information
- Vendor
- Geoserver
- Status
- Geoserver
- Vendor
- CVE Published:
- 1 July 2024
Badges
Summary
A remote code execution vulnerability (CVE-2024-36401) in GeoServer versions 2.23.6, 2.24.4, and 2.25.2 allows unauthenticated users to execute arbitrary code through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The vulnerability affects all GeoServer instances and can be exploited through various requests, potentially leading to executing arbitrary code. The vendor, Geoserver, has released patches for the affected versions and advises users to remove a specific file as a workaround. The potential impact of exploitation is severe, with the risk of unauthorized access and control over affected systems. The article also mentions another security issue related to polyfill.io and steps taken to protect against it.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-36401 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.
The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
geoserver < 2.23.6
geoserver < 2.24.0, 2.24.4
geoserver < 2.25.0, 2.25.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC
APT & Targeted Attacks We observed Earth Baxia carrying out targeted attacks against APAC countries that involved advanced techniques like spear-phishing and customized malware, with data suggesting that...
3 months ago
Security Affairs CVE-2024-36401Multiple malware families delivered exploiting GeoServer GeoTools flaw CVE-2024-36401
Multiple threat actors actively exploited the recently disclosed OSGeo GeoServer GeoTools flaw CVE-2024-36401 in malware-based campaigns.
3 months ago
Hackread CVE-2024-36401Critical GeoServer Vulnerability Exploited in Global Malware Campaign
A critical GeoServer vulnerability is being exploited, allowing attackers to take control of systems for malware, cryptojacking, and botnet attacks.
3 months ago
EPSS Score
95% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 👾
Exploit exists.
Vulnerability started trending.
Vulnerability published.
First article discovered by Astun Technology
Vulnerability Reserved.