PT-2024-4472 · Geoserver · Geoserver

Sikeoka · Published 2024-06-04 · Updated 2026-06-24 · CVE-2024-36401

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions GeoServer versions prior to 2.22.6 GeoServer versions prior to 2.23.6 GeoServer versions prior to 2.24.4 GeoServer versions prior to 2.25.2

Description GeoServer is an open-source server used for sharing and editing geospatial data. An issue exists where the GeoTools library API unsafely evaluates property or attribute names for feature types, passing them to the commons-jxpath library. This allows unauthenticated remote attackers to execute arbitrary code by sending specially crafted OGC requests, as property names are incorrectly evaluated as XPath expressions (a language used for navigating through elements and attributes in an XML document) for both simple and complex feature types. This affects all GeoServer instances in a default installation.

Exploitation has been confirmed via the following endpoints:

• 'WFS GetFeature'
• 'WFS GetPropertyValue'
• 'WMS GetMap'
• 'WMS GetFeatureInfo'
• 'WMS GetLegendGraphic'
• 'WPS Execute'

Real-world incidents include breaches of a U.S. federal agency, where the flaw was used for initial access and lateral movement. Additionally, campaigns by botnets such as Mirai and PolarEdge have exploited this to deploy coin miners (specifically for Monero), web shells, and other malware across Windows and Linux platforms. It is estimated that over 16,000 internet-exposed instances were at risk.

Recommendations Update GeoServer to version 2.22.6. Update GeoServer to version 2.23.6. Update GeoServer to version 2.24.4. Update GeoServer to version 2.25.2. As a temporary workaround, remove the gt-complex-x.y.jar file (where x.y represents the GeoTools version, e.g., gt-complex-31.1.jar) from the GeoServer installation to remove the vulnerable code, though this may disrupt some functionality or prevent deployment if the gt-complex module is required.

Exploit

Fix

RCE

Code Injection

Eval Injection

Weakness Enumeration

CWE-94

CWE-95

Related Identifiers

BDU:2024-04974

CVE-2024-36401

GHSA-6JJ6-GM7P-FCVV

GHSA-W3PJ-WH35-FQ8W

Affected Products

Geoserver

References · 302

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/multi/http/geoserver_unauth_rce_cve_2024_36401.rb · Exploit
• 🔥 https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w · Exploit
• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/36xxx/CVE-2024-36401.json · Exploit
• 🔥 https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852 · Exploit
• 🔥 https://github.com/Chocapikk/CVE-2024-36401 · Exploit
• 🔥 https://github.com/bigb0x/CVE-2024-36401 · Exploit
• 🔥 https://github.com/Mr-xn/CVE-2024-36401 · Exploit
• 🔥 https://github.com/ahisec/geoserver- · Exploit
• 🔥 https://github.com/netuseradministrator/CVE-2024-36401 · Exploit
• 🔥 https://github.com/thestar0/CVE-2024-36401-WoodpeckerPlugin · Exploit
• 🔥 https://github.com/daniellowrie/CVE-2024-36401-PoC · Exploit
• 🔥 https://github.com/Niuwoo/CVE-2024-36401 · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-36401-poc · Exploit
• 🔥 https://github.com/justin-p/geoexplorer · Exploit
• 🔥❌ https://github.com/MInggongK/geoserver- · Exploit, Deleted