Remote Code Execution Vulnerability in GeoServer Prior to Versions 2.23.6, 2.24.4, and 2.25.2
Key Information
- Vendor
- Geoserver
- Status
- Geoserver
- Vendor
- CVE Published:
- 1 July 2024
Badges
Summary
A remote code execution vulnerability (CVE-2024-36401) in GeoServer versions 2.23.6, 2.24.4, and 2.25.2 allows unauthenticated users to execute arbitrary code through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The vulnerability affects all GeoServer instances and can be exploited through various requests, potentially leading to executing arbitrary code. The vendor, Geoserver, has released patches for the affected versions and advises users to remove a specific file as a workaround. The potential impact of exploitation is severe, with the risk of unauthorized access and control over affected systems. The article also mentions another security issue related to polyfill.io and steps taken to protect against it.
CISA Reported
CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2024-36401 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace
The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Version(s)
geoserver < 2.23.6
geoserver < 2.24.0, 2.24.4
geoserver < 2.25.0, 2.25.2
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.
News Articles
CybersecurityNews CVE-2024-36401Hackers Actively Exploiting GeoServer RCE Flaw, 6635 Servers Vulnerable
A critical vulnerability in GeoServer, an open-source Java-based software server, has put thousands of servers at risk.
2 months ago
darkwebinformer.com CVE-2024-36401PoC Released for GeoServer Exploit CVE-2024-36401
GeoServer is an open-source Java-based software server that enables users to view, edit, and share geospatial data. It offers a versatile and efficient solution for distributing geospatial information from various sources such as GIS databases, web-based data, and personal datasets. In versions of ...
2 months ago
EPSS Score
95% chance of being exploited in the next 30 days.
CVSS V3.1
Timeline
- 👾
Exploit exists.
Vulnerability started trending.
Vulnerability published.
First article discovered by Astun Technology
Vulnerability Reserved.