Security Advisory

CVE-2024-36401

About

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.

The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code.

Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

Weakness (CWE):CWE-95 CWE-94

Rainforest analyst review

The vulnerability is in how GeoServer evaluates OGC request parameters. Through the underlying GeoTools library, property or attribute names in requests are passed to the commons-jxpath library and evaluated as XPath expressions, and jxpath's XPath evaluation can invoke arbitrary Java. This XPath handling was meant only for complex Application Schema feature types but is wrongly applied to simple feature types too, so it affects default installations. An unauthenticated attacker sends a crafted WFS GetFeature, WMS GetMap, or WPS Execute request and runs code on the server.

GeoServer is widely deployed open-source software for publishing geospatial data, frequently internet-facing so that maps and layers can be served to clients, which puts the vulnerable request handlers directly in reach of anyone. Because exploitation works through normal-looking OGC requests against a stock configuration and public exploitation followed disclosure, exposed servers should be checked for compromise. Upgrade to 2.22.6, 2.23.6, 2.24.4, or 2.25.2 or later; if you cannot patch at once, the documented workaround of removing the gt-complex JAR blocks the vulnerable code at the cost of some functionality. Inspect hosts for planted web shells and miners.

References

Frequently asked questions

What is CVE-2024-36401?

How severe is CVE-2024-36401?

CVE-2024-36401 carries a CVSS 3.1 base score of 9.8, rated critical. On the Rainforest Risk Index — which weighs the severity alongside how easy the flaw is to reach and how broad its impact is — it scores 99 out of 100, in the critical band.

How is CVE-2024-36401 exploited?

According to the CVSS vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H): attack vector Network, attack complexity Low, privileges required None, user interaction None. Impact on confidentiality High, integrity High and availability High.

Which products are affected by CVE-2024-36401?

Public advisories list the following as affected: geoserver, geotools. Check the references on this page for the exact versions each vendor confirms.

How do I fix CVE-2024-36401?

Apply the fix the vendor published — the references on this page link to the primary advisories and patches. When patching can't happen right away, reduce the exposure of the affected component and watch it for exploitation attempts. Rainforest customers see this vulnerability correlated to their own assets and prioritized by real exposure, not by score alone.

Empower Your Security Strategy with Rainforest

Discover vulnerabilities early, prioritize critical threats, and protect what truly matters. Rainforest streamlines your security operations, saving you time and reducing costs, so you can focus on what drives your business forward.

Book a Demo