CVE-2024-36401
OSGeo GeoServer GeoTools Eval Injection Vulnerability
Description
CVE-2024-36401 is a critical remote code execution vulnerability in GeoServer, an open-source server for sharing and editing geospatial data. The flaw exists in how OGC request parameters are processed, where property names are unsafely evaluated as XPath expressions, allowing unauthenticated users to execute arbitrary code on default GeoServer installations. Affecting GeoServer versions before 2.22.6, 2.23.6, 2.24.4, and 2.25.2, as well as the underlying GeoTools library, this vulnerability carries a CVSS v3.1 base score of 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H). It is listed in CISA's KEV catalog with a remediation deadline of August 5, 2024, and has an EPSS score of 0.94425 (100.0th percentile).
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| geoserver | geoserver | < 2.22.6; >= 2.23.0, < 2.23.6; >= 2.24.0, < 2.24.4; >= 2.25.0, < 2.25.2 |
| geotools | geotools | < 29.6; >= 30.1, < 30.4; >= 31.1, < 31.2; 30.0; 31.0 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852(Exploit, Third Party Advisory)
- https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv(Mitigation, Vendor Advisory)
- https://github.com/geotools/geotools/pull/4797(Issue Tracking, Patch)
- https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w(Exploit, Vendor Advisory)
- https://osgeo-org.atlassian.net/browse/GEOT-7587(Vendor Advisory)
- https://www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36401(US Government Resource)
Weakness Type
Unsafe XPath Expression Evaluation Leading to Code Execution
CVE-2024-36401 arises from the unsafe evaluation of property names as XPath expressions within the GeoTools library API, which is utilized by GeoServer. Multiple OGC (Open Geospatial Consortium) request parameters are processed through code paths that evaluate user-supplied property names using XPath. Since XPath evaluation in Java can invoke arbitrary methods through expression language extensions, an attacker can inject malicious XPath expressions that execute system commands on the server. The root cause lies in the GeoTools library's property name handling, which does not distinguish between safe property lookups and potentially dangerous expression evaluations, creating a code injection pathway accessible through standard GeoServer web service requests.
Impact Analysis
Complete Geospatial Server Compromise is the direct consequence of CVE-2024-36401. GeoServer is widely deployed by government agencies, utilities, environmental organizations, and enterprises for managing geospatial data. Successful exploitation provides full remote code execution on the server hosting GeoServer.
Confidentiality Impact is maximum (C:H). Code execution on a GeoServer instance grants access to all geospatial data managed by the server, including potentially sensitive location data, infrastructure maps, environmental monitoring data, and any other datasets served through the platform. Many GeoServer deployments contain classified or restricted geospatial intelligence used for critical infrastructure planning, military operations, or environmental protection.
Integrity Impact is maximum (I:H). An attacker with code execution can modify geospatial data, alter map layers, inject false information into datasets, and manipulate the spatial data that downstream applications and decision-making processes depend on. In contexts such as emergency management, urban planning, or military operations, corrupted geospatial data can have severe real-world consequences.
Availability Impact is maximum (A:H). The attacker can disable the GeoServer instance, destroy geospatial databases, or use the compromised server for further attacks. Organizations that depend on GeoServer for real-time geospatial services, such as emergency response systems or navigation services, face critical operational disruptions.
Exploitation Context: The EPSS score of 0.94425 (100.0th percentile) places this among the most actively exploited vulnerabilities. CISA's KEV listing with a remediation deadline of August 5, 2024, underscores the urgency. CISA lists the ransomware association as "Unknown," but the code execution capability enables any post-exploitation objective including ransomware deployment.
Exploit Maturity
CVE-2024-36401 is confirmed as actively exploited in the wild, as documented by its listing in CISA's KEV catalog with a remediation deadline of August 5, 2024. The EPSS score of 0.94425 at the 100.0th percentile confirms it is among the most actively targeted vulnerabilities globally.
Multiple Public Exploits: Several public exploits and proof-of-concept demonstrations are available. Vicarius published exploit details demonstrating the RCE chain. The GeoTools security advisory and GeoServer security advisory provide technical details and mitigation guidance. An earlier related vulnerability CVE-2022-41852 workaround provides additional context on the XPath expression evaluation attack class.
Default Installation Vulnerable: The vulnerability affects default GeoServer installations without requiring any special configuration, meaning any GeoServer instance that has not been specifically hardened or patched is vulnerable. This dramatically increases the attack surface.
Underlying Library Flaw: The vulnerability originates in the GeoTools library (patch available), meaning any application using vulnerable GeoTools versions for property name evaluation may also be affected, extending the risk beyond GeoServer itself.
Ransomware Association: CISA lists the ransomware status as "Unknown." The ease of exploitation, unauthenticated access, and code execution capability make this vulnerability suitable for both targeted attacks and mass exploitation campaigns.
Remediation
-
Update GeoServer immediately to a patched version. Upgrade to GeoServer 2.22.6, 2.23.6, 2.24.4, or 2.25.2 (or later) depending on your release branch. Follow the migration guidance in the GeoServer security advisory GHSA-6jj6-gm7p-fcvv. The updated versions include fixes for the unsafe XPath expression evaluation in OGC request handling.
-
Update the GeoTools library to versions 29.6, 30.4, or 31.2 (or later) as referenced in the GeoTools patch PR #4797. If you use GeoTools in custom applications beyond GeoServer, ensure those applications are also updated to prevent XPath expression injection through property name evaluation.
-
Apply the workaround for unpatched instances if immediate updating is not feasible. The GeoServer advisory provides a temporary workaround that can mitigate the vulnerability by removing the vulnerable XPath evaluation code path. Refer to the GHSA-6jj6-gm7p-fcvv advisory for specific workaround instructions. This should be treated as a temporary measure until patching is complete.
-
Restrict network access to GeoServer by implementing firewall rules that limit access to the GeoServer web interface and OGC service endpoints. If GeoServer does not need to be publicly accessible, restrict access to known internal networks. Use a reverse proxy with WAF capabilities to filter malicious OGC requests containing XPath injection payloads.
-
Audit for indicators of compromise by reviewing GeoServer access logs for suspicious OGC requests containing unusual property names or XPath expressions. Check for signs of command execution such as new processes spawned by the GeoServer Java process, unexpected outbound network connections, newly created files or user accounts, and modifications to GeoServer data or configuration.
Technical Details
CVE-2024-36401 is a critical remote code execution vulnerability in GeoServer caused by unsafe evaluation of OGC request property names as XPath expressions in the GeoTools library.
CVSS Vector Breakdown: The vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H produces a base score of 9.8. The network attack vector (AV:N) enables remote exploitation through GeoServer's web service interface. Low attack complexity (AC:L) reflects the straightforward nature of injecting XPath expressions through standard OGC request parameters. No privileges (PR:N) or user interaction (UI:N) are required. The scope is unchanged (S:U), and all impact metrics are maximum (C:H/I:H/A:H), reflecting complete server compromise.
Vulnerability Mechanism: GeoServer implements OGC web services (WFS, WMS, WCS, etc.) that accept various request parameters including property names that specify which data attributes to return. These property names are processed by the GeoTools library API, which evaluates them as XPath expressions. In Java, XPath evaluation engines can invoke arbitrary static methods through the function call mechanism, allowing an attacker to inject XPath expressions that call Runtime.exec() or similar methods to execute system commands.
Attack Vector: An attacker sends a standard OGC request (such as a WFS GetPropertyValue request) to the GeoServer endpoint with a specially crafted property name parameter. Instead of a legitimate property name like "the_geom," the attacker provides a malicious XPath expression that invokes Java methods for command execution. The GeoTools library processes this expression through its XPath evaluator, which executes the embedded method calls, resulting in arbitrary command execution on the server.
GeoTools Library Origin: The vulnerability is rooted in the GeoTools library (tracked separately as GHSA-w3pj-wh35-fq8w), specifically in how property names are resolved. The fix (PR #4797) modifies the property name evaluation to prevent XPath expression injection. Affected GeoTools versions span multiple release branches: before 29.6, 30.0, 30.1 through 30.4, 31.0, and 31.1 through 31.2.
Frequently Asked Questions
What is CVE-2024-36401?
CVE-2024-36401 is a critical remote code execution vulnerability in GeoServer, the popular open-source geospatial data server. It allows unauthenticated attackers to execute arbitrary commands by injecting malicious XPath expressions through standard OGC web service request parameters. The vulnerability affects default GeoServer installations and requires no special configuration to exploit.
Which GeoServer versions are affected?
GeoServer versions before 2.22.6, 2.23.0 through 2.23.5, 2.24.0 through 2.24.3, and 2.25.0 through 2.25.1 are affected. The underlying GeoTools library versions before 29.6, as well as versions 30.0 through 30.3 and 31.0 through 31.1, are also vulnerable. Update to GeoServer 2.22.6, 2.23.6, 2.24.4, or 2.25.2 or later.
Is CVE-2024-36401 being actively exploited?
Yes. CISA has confirmed active exploitation by listing it in the KEV catalog with the earliest remediation deadline (August 5, 2024) among the recent additions. The EPSS score of 0.94425 (100.0th percentile) indicates maximum exploitation activity. Multiple public exploit tools and proof-of-concept code are available.
Are other applications using GeoTools also vulnerable?
Potentially yes. The vulnerability originates in the GeoTools library's property name evaluation logic. Any application that uses affected GeoTools versions and processes user-supplied property names through the vulnerable code path may be susceptible to the same XPath expression injection attack. Check your GeoTools version and update accordingly.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.