CVE-2024-36401
Published: 01 July 2024
Summary
CVE-2024-36401 is a critical-severity Eval Injection (CWE-95) vulnerability in Geotools Geotools. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked in the top 0.0% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-2 (Flaw Remediation).
Deeper analysis
GeoServer is an open source server for sharing and editing geospatial data that is affected by CVE-2024-36401 in all installations prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2. The root cause lies in the GeoTools library, which passes feature-type property names to the commons-jxpath component for XPath evaluation; this logic was intended only for complex feature types but is incorrectly applied to simple feature types as well, enabling remote code execution when attacker-controlled values are processed.
Unauthenticated remote attackers can supply crafted OGC request parameters over WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic, or WPS Execute endpoints. Because the server evaluates these inputs as XPath expressions without authentication or additional restrictions, successful exploitation yields arbitrary code execution on the underlying host with a CVSS score of 9.8.
Official advisories from the GeoServer and GeoTools projects recommend immediate upgrade to the listed patched releases. As a workaround, administrators may delete the gt-complex-x.y.jar file from the GeoServer installation, although this can disable required functionality or prevent startup when the module is needed. The associated EPSS score remains high, with a current value of 0.9443 and a recorded peak of 0.9618.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-2280
Vulnerability details
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against…
more
a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.
- CWE(s)
- KEV Date Added
- 15 July 2024
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
CVE-2024-36401 enables unauthenticated remote code execution by exploiting a public-facing GeoServer web application through specially crafted OGC requests (WFS, WMS, WPS), directly mapping to exploitation of public-facing applications.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly blocks the unsanitized OGC request parameters that are evaluated as XPath expressions leading to RCE.
Requires prompt application of the vendor patches (2.22.6/2.23.6/2.24.4/2.25.2) that eliminate the unsafe commons-jxpath code path.
Supports removal of gt-complex-*.jar (or disabling the complex feature-type module) to eliminate the vulnerable code while accepting reduced functionality.