Remote Code Execution Vulnerability in GeoServer Prior to Versions 2.23.6, 2.24.4, and 2.25.2
CVE-2024-36401
Key Information
- Vendor
- Geoserver
- Status
- Geoserver
- Vendor
- CVE Published:
- 1 July 2024
Badges
What is CVE-2024-36401?
CVE-2024-36401 is a remote code execution vulnerability found in GeoServer, an open-source server designed for sharing and editing geospatial data. This vulnerability can be exploited by unauthenticated attackers through specially crafted input aimed at certain OGC request parameters in versions prior to 2.23.6, 2.24.4, and 2.25.2. The flaw allows attackers to execute arbitrary code on the server, posing significant risks to the integrity, confidentiality, and availability of the organization's geospatial data assets.
Technical Details
The vulnerability arises from the unsafe evaluation of property names as XPath expressions by the GeoTools library used within GeoServer. Specifically, the library inappropriately applies XPath evaluation to simple feature types, leading to the potential for arbitrary code execution. This issue is exploitable via various Web Feature Service (WFS) and Web Map Service (WMS) requests, making all instances of GeoServer vulnerable if they are operating on affected versions. A patch has been released in subsequent versions, and a temporary workaround involves removing a specific GeoTools jar file, though this may affect certain functionalities within GeoServer.
Impact of the Vulnerability
-
Remote Code Execution: Attackers can exploit the vulnerability to execute arbitrary code on GeoServer instances, potentially allowing them to gain control over the server.
-
Data Integrity Compromise: The ability to run unauthorized code could lead to unauthorized modifications of geospatial datasets and impede the accuracy and reliability of critical information.
-
Service Disruption: Organizations may experience service outages or degraded performance as a result of exploit attempts or malicious activities facilitated by the vulnerability, impacting overall operations and user access to geospatial data.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-36401 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace as recent news articles suggest the vulnerability is being used by ransomware groups.
The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
geoserver < 2.23.6
geoserver < 2.24.0, 2.24.4
geoserver < 2.25.0, 2.25.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
Earth Baxia Uses Spear-Phishing and GeoServer Exploit to Target APAC
APT & Targeted Attacks We observed Earth Baxia carrying out targeted attacks against APAC countries that involved advanced techniques like spear-phishing and customized malware, with data suggesting that...
3 months ago
Security AffairsCVE-2024-36401Multiple malware families delivered exploiting GeoServer GeoTools flaw CVE-2024-36401
Multiple threat actors actively exploited the recently disclosed OSGeo GeoServer GeoTools flaw CVE-2024-36401 in malware-based campaigns.
3 months ago
HackreadCVE-2024-36401Critical GeoServer Vulnerability Exploited in Global Malware Campaign
A critical GeoServer vulnerability is being exploited, allowing attackers to take control of systems for malware, cryptojacking, and botnet attacks.
4 months ago
Refferences
EPSS Score
95% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 🔴
Public PoC available
- 😈
Used in Ransomware
Vulnerability started trending
- 👾
Exploit known to exist
CISA Reported
Vulnerability published
First article discovered by Astun Technology
Vulnerability Reserved