Skip to main content

CVE-2024-36401

OSGeo — OSGeo GeoServer GeoTools Eval Injection Vulnerability

OSGeo · CWE-95 | CWE-94 — Code injection · in CISA KEV since 2024-07-15

ExigentKEV since 2024 · listed over a yearCISA KEVActively Exploited
87

EVRS 87 of 100 Immediate

Out-of-Band / Urgent Remediation

Rank 236 of 2,960 tracked

Download PDF

Why it scores 87

Evidence available: 6 of 7 signals

Listed in the CISA KEV catalog, and an EPSS probability of 0.998.

  • CISA KEVApplied
  • RansomwareDid not apply
  • Vendor exploitationDid not apply
  • EPSSApplied
  • Microsoft Exploitability IndexNot applicable
  • Pre-patch disclosureNo data
  • KEV recencyDid not apply
  • CVSSApplied

The band answers “how soon”, not “how bad”. No data for: Pre-patch disclosure. Why some signals show no data

Fix

Patch or fixed version identified

CISA required action

Fixed in

  • org.geoserver.web:gs-web-app2.24.42.25.22.23.6update to this version or later in your release line
  • org.geoserver:gs-wfs2.24.42.25.22.23.6update to this version or later in your release line
  • org.geoserver:gs-wms2.24.42.25.2update to this version or later in your release line

Affected versions

  • org.geoserver.web:gs-web-app (maven)affected >= 2.24.0, < 2.24.4, fixed in 2.24.4affected >= 2.25.0, < 2.25.2, fixed in 2.25.2affected >= 2.23.0, < 2.23.6, fixed in 2.23.6
  • org.geoserver:gs-wfs (maven)affected >= 2.24.0, < 2.24.4, fixed in 2.24.4affected >= 2.25.0, < 2.25.2, fixed in 2.25.2affected >= 2.23.0, < 2.23.6, fixed in 2.23.6
  • org.geoserver:gs-wms (maven)affected >= 2.24.0, < 2.24.4, fixed in 2.24.4affected >= 2.25.0, < 2.25.2, fixed in 2.25.2

Remediation

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Fixed versions from NVD and GitHub. Affected packages also in GitHub Advisory GHSA-6jj6-gm7p-fcvv (CC BY 4.0). It lists 4 more packages; see GHSA-6jj6-gm7p-fcvv on GitHub for the full list.

Evidence

Each value with its source
MeasureValueSource
CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. 9.8 NVD
FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. 0.998 (99.96th pctl) FIRST EPSS
Actively exploitedWhether a source of record has confirmed attacks using it in the wild. Confirmed CISA KEV
Ransomware campaign useWhether CISA has seen ransomware operators use it. Unknown or none CISA KEV
CISA remediation deadlineThe date US federal agencies must have fixed or mitigated it. 2024-08-05 · KEV since 2024 · listed over a year CISA KEV
Public exploit moduleA module existing is not the same as active exploitation. Public module exists Metasploit
EUVD cross-referenceENISA's record: CVSS 9.8 (v3.1), assigned by GitHub_M. Listed ENISA EUVD

Description

NVD

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

What CISA says to do

Public module

Metasploit lists a public excellent-rank module for this CVE: Geoserver unauthenticated Remote Code Execution (multi/http/geoserver_unauth_rce_cve_2024_36401). A module existing is not the same as active exploitation; see metasploit.com.