CVE-2024-34696

Executive Summary

CVE-2024-34696 is an information disclosure vulnerability in GeoServer, an open-source server for sharing geospatial data. The flaw affects versions starting from 2.10.0 up to (but not including) 2.24.4 and 2.25.1. It allows any user with administrative rights to view all environment variables and Java system properties via the Server Status page and the REST API. These variables often contain sensitive credentials such as database passwords, API keys, and tokens, especially in containerized deployments where credentials are passed as environment variables. The vulnerability has a CVSS score of 4.5 (Medium) and is classified under CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor). While the attack requires administrative privileges, it defeats more sophisticated security controls like break-glass access to secrets or role accounts. The official fix is to upgrade to GeoServer 2.24.4 or 2.25.1, which hides these variables by default. A workaround is to manually configure the system to hide environment variables and Java properties.

Supply Chain & Package Security

GeoServer is a Java-based application distributed as a WAR file or via Docker images. The vulnerability is not in a package manager (NPM, PyPI, Go, Ruby) but in the core application. However, many community-maintained Docker images for GeoServer export credentials as environment variables in their startup scripts, which are then exposed by this vulnerability. Users should verify the integrity of their container images and ensure they are using official or trusted sources.

CVSS Breakdown & Threat Level

• CVSS Score: 4.5 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
• Attack Vector: Network (AV:N) – The vulnerability can be exploited remotely.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: High (PR:H) – The attacker must have administrative credentials.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Sensitive information is fully disclosed.
• Integrity Impact: None (I:N) – No data modification is possible.
• Availability Impact: None (A:N) – No denial of service.

Threat Level: Medium. The requirement for administrative privileges reduces the likelihood of exploitation by external attackers, but the potential for credential theft makes it a significant insider threat or post-exploitation vector.

Deep Dive & Mechanics

GeoServer provides a Server Status page (accessible via the web UI) and a REST API endpoint (/rest/about/status) that display system information to administrators. This information includes all environment variables and Java system properties. In containerized environments, it is common practice to pass sensitive configuration (e.g., database passwords, API keys) as environment variables. The vulnerability arises because GeoServer does not filter or mask these variables before displaying them.

The about/status API endpoint is protected by authentication and authorization checks, ensuring only administrators can access it. However, once an administrator is authenticated, the endpoint returns a JSON or HTML response containing the full list of environment variables and Java properties. This defeats security controls that rely on secrets being accessible only through specific mechanisms (e.g., vaults, break-glass procedures).

The fix in versions 2.24.4 and 2.25.1 introduces a configuration option to hide environment variables and Java system properties by default. Administrators can choose to re-enable this feature, but the documentation now warns about the risks.

Vulnerable vs. Patched Code

Vulnerable Code (Pre-2.24.4 / 2.25.1): In the StatusController or similar class, the code retrieves and returns all environment variables and system properties without filtering.

// Vulnerable: Returns all environment variables
Map<String, String> env = System.getenv();
// Returns all system properties
Properties props = System.getProperties();
// Both are included in the response

Patched Code (2.24.4 / 2.25.1): The patched version introduces a configuration flag (e.g., GEOSERVER_HIDE_ENV_VARS) that defaults to true. When enabled, the environment variables and system properties are not included in the response.

// Patched: Check configuration before exposing
boolean hideEnvVars = GeoServerConfig.getBoolean("GEOSERVER_HIDE_ENV_VARS", true);
if (!hideEnvVars) {
    Map<String, String> env = System.getenv();
    // Include in response
}

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Valid administrative credentials for a GeoServer instance (version 2.10.0 to 2.24.3 or 2.25.0).
• Network access to the GeoServer web interface or REST API.

Exploitation Steps:

1. Authenticate as an administrator via the web UI or REST API.
2. Access the Server Status page (e.g., http://target/geoserver/web/?wicket:bookmarkablePage=:org.geoserver.web.admin.StatusPage).
3. Alternatively, query the REST API:

   curl -u admin:password http://target/geoserver/rest/about/status
   

4. Parse the response to extract environment variables and Java properties. Look for keys like DB_PASSWORD, API_KEY, SECRET_TOKEN, etc.
5. Use the extracted credentials to pivot to other systems (e.g., databases, cloud services).

Lab Setup:

• Deploy a vulnerable GeoServer instance using Docker:

  docker run -d -p 8080:8080 -e DB_PASSWORD=supersecret -e API_KEY=12345 --name geoserver-vuln geoserver:2.24.3
  

• Access the web UI at http://localhost:8080/geoserver and log in with default credentials (admin/geoserver).
• Navigate to the Server Status page to see the exposed environment variables.

Blue Team (Defender)

Detection:

• Monitor for administrative access to the /rest/about/status endpoint.
• Alert on unusual patterns of API calls by administrators (e.g., repeated status queries).
• Use the detection rules provided in the Detection Engineering section.

Hunting:

• Search logs for requests to /rest/about/status or /web/?wicket:bookmarkablePage=:org.geoserver.web.admin.StatusPage.
• Correlate with subsequent outbound connections to unknown IPs or services (potential credential exfiltration).

Mitigation:

• Apply the patch immediately (upgrade to 2.24.4 or 2.25.1).
• If patching is not possible, configure GeoServer to hide environment variables (set GEOSERVER_HIDE_ENV_VARS=true in the configuration).
• Review container images and avoid passing sensitive credentials as environment variables. Use secrets management solutions instead.

Indicators of Compromise (IOCs)

• Network:
  • HTTP requests to /geoserver/rest/about/status with a valid admin session.
  • HTTP requests to /geoserver/web/?wicket:bookmarkablePage=:org.geoserver.web.admin.StatusPage.
• Logs:
  • GeoServer access logs showing repeated access to the status endpoint by the same user.
  • Application logs containing environment variable names (e.g., DB_PASSWORD, API_KEY).
• System:
  • Unusual outbound connections from the GeoServer host to external IPs after status page access.
  • New processes or scripts that read environment variables (e.g., env command).

Detection Engineering

YARA Rule

rule GeoServer_EnvVar_Exposure {
    meta:
        description = "Detects GeoServer responses containing environment variable exposure"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-34696"
    strings:
        $env_pattern = /(?:DB_PASSWORD|API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIALS)\s*[:=]\s*\S+/i
        $status_page = "org.geoserver.web.admin.StatusPage"
        $rest_endpoint = "/rest/about/status"
    condition:
        any of ($env_pattern) and ($status_page or $rest_endpoint)
}

Sigma Rule

title: GeoServer Environment Variable Exposure via Status Page
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to GeoServer status endpoints that may expose sensitive environment variables.
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-34696
logsource:
    category: webserver
    product: apache
    service: access_log
detection:
    selection:
        cs-uri-stem:
            - "/geoserver/rest/about/status"
            - "/geoserver/web/"
        cs-uri-query:
            - "*wicket:bookmarkablePage=:org.geoserver.web.admin.StatusPage*"
    condition: selection
falsepositives:
    - Legitimate administrative monitoring
level: medium
tags:
    - attack.t1087
    - cve.2024.34696

Suricata Rule

alert http any any -> any any (msg:"GeoServer Environment Variable Exposure via REST API"; flow:to_server; content:"/rest/about/status"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)
alert http any any -> any any (msg:"GeoServer Environment Variable Exposure via Web UI"; flow:to_server; content:"/geoserver/web/"; http_uri; content:"wicket:bookmarkablePage=:org.geoserver.web.admin.StatusPage"; http_uri; classtype:attempted-recon; sid:1000002; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade GeoServer to version 2.24.4 or 2.25.1 (or later).
2. If upgrade is not possible, set the configuration option to hide environment variables:
   • In geoserver/WEB-INF/web.xml, add:

     <context-param>
         <param-name>GEOSERVER_HIDE_ENV_VARS</param-name>
         <param-value>true</param-value>
     </context-param>
     

   • Or set the system property -DGEOSERVER_HIDE_ENV_VARS=true when starting the Java process.
3. Review container images and avoid passing sensitive data as environment variables. Use Docker secrets, Kubernetes secrets, or a vault solution.
4. Audit administrative accounts and ensure least privilege principles are applied.

Long-Term Measures:

• Implement a secrets management solution (e.g., HashiCorp Vault, AWS Secrets Manager).
• Enable logging and monitoring for all administrative actions.
• Conduct regular security reviews of container configurations.

Workaround:

• If patching is delayed, restrict access to the Server Status page and REST API using network controls (e.g., firewall rules, reverse proxy authentication).

Valters IT
DevSecOps & Cyber Threat Intelligence Expert