CVE-2024-36401

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.22.6 GeoServer versions prior to 2.23.6 GeoServer versions prior to 2.24.4 GeoServer versions prior to 2.25.2 GeoTools versions prior to 29.6 GeoTools versions prior to 30.4 GeoTools versions prior to 31.2

Description GeoServer is an open-source server used for sharing and editing geospatial data. A vulnerability exists due to unsafe evaluation of property names as XPath expressions, allowing unauthenticated users to execute arbitrary code through specially crafted input against a default GeoServer installation. The GeoTools library API used by GeoServer evaluates property/attribute names in a way that passes them unsafely to the commons-jxpath library, which can execute arbitrary code when evaluating XPath expressions. This vulnerability affects all GeoServer instances. Multiple request types, including WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic, and WPS Execute, can be used to exploit this issue. Recent campaigns have leveraged this vulnerability to deploy malware, including NetCat, XMRig, SideWalk, and GOREVERSE, and to monetize victims' bandwidth. The Earth Baxia APT group has been observed exploiting this vulnerability to target government and energy sectors in the APAC region. A U.S. federal agency was also compromised through this vulnerability.

Recommendations For GeoServer versions prior to 2.22.6, update to version 2.22.6 or later. For GeoServer versions prior to 2.23.6, update to version 2.23.6 or later. For GeoServer versions prior to 2.24.4, update to version 2.24.4 or later. For GeoServer versions prior to 2.25.2, update to version 2.25.2 or later. For GeoTools versions prior to 29.6, update to version 29.6 or later. For GeoTools versions prior to 30.4, update to version 30.4 or later. For GeoTools versions prior to 31.2, update to version 31.2 or later. As a workaround, remove the

gt-complex-x.y.jar

file from the GeoServer installation, where

x.y

is the GeoTools version. Note that this may break some GeoServer functionality.