CVE-2024-36401

GeoServer is like a “server front door” that lets others request and view geospatial data and maps. In this vulnerability, attackers can send specially crafted requests that trick GeoServer into evaluating attacker-controlled text in a way that can run code on the server—without needing a login. Think of it like someone being able to send a message that causes your server to “obey” it as if it were programming instructions, not just a map request.

This matters if your business runs GeoServer (including its web, WFS, and WMS components) or the relevant GeoTools component on a server reachable over the network. The key gate is that the flaw is exploitable without authentication, so it’s especially serious for any GeoServer instance exposed to the internet or otherwise reachable by untrusted clients. The GeoServer version must be older than the fixed versions listed by the vendor for this to apply.

This is RED because it has been added to CISA’s KEV list and has confirmed real-world exploitation, meaning attackers are using it against reachable targets. The flaw allows unauthenticated remote code execution, so exposure to untrusted networks can turn it into an immediate compromise risk. Apply the fixed versions or the vendor workaround without delay—by the KEV remediation deadline (2024-08-05).

Confirm whether we’re affected

1. Identify our deployment:
   • GeoServer version (for the running GeoServer instance).
   • Whether we use/enable the components corresponding to org.geoserver.web:gs-web-app, org.geoserver:gs-wfs, and org.geoserver:gs-wms.
   • The GeoTools version used by this GeoServer installation.
2. Compare versions to the fixed releases:
   • GeoServer modules are fixed in 2.24.4 (and the vendor remediation also provides lines that include 2.25.2).
   • GeoTools is fixed in 29.6.
3. Exposure check (reachability gate):
   • If GeoServer is internet-facing or otherwise reachable by untrusted network clients, treat it as exposed for mitigation purposes because the vulnerability does not require authentication.

Upgrade path (preferred)

1. Upgrade GeoServer components to fixed versions:
   • org.geoserver.web:gs-web-app → fixed in 2.24.4
   • org.geoserver:gs-wfs → fixed in 2.24.4
   • org.geoserver:gs-wms → fixed in 2.24.4
   • If our environment targets the higher line, the vendor also indicates versions at/above 2.25.2 are part of the fixed remediation set.
2. Upgrade GeoTools to 29.6 (for stacks using/updating GeoTools separately).
3. After upgrading, validate GeoServer functionality (basic OGC endpoints such as WFS/WMS and any configured feature querying features), since module behavior may change across versions.

Temporary workaround (if patching is delayed)

1. Remove the vulnerable GeoServer module JAR:
   • Delete gt-complex-x.y.jar where x.y is the GeoTools/GeoServer complex module version present in the installation (example given: gt-complex-31.1.jar for GeoServer 2.25.1).
2. Confirm deployment behavior:
   • The workaround may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is required.
3. Treat this as a stopgap while the fixed upgrade is scheduled.

Timing requirement

• CISA KEV remediation due date: 2024-08-05.

What to monitor

• GeoServer/WAF/proxy logs for unusual or malformed OGC requests targeting WFS/WMS/WPS endpoints.
• System indicators of compromise after exposure windows (unexpected processes, outbound connections, changes on the server), prioritizing timeframes when GeoServer was internet-reachable.

Severity is critical (remote code execution with full impact). The core mechanism is unsafe evaluation of “property name” inputs as XPath expressions (CWE-95, CWE-94), which can be abused to execute arbitrary code. The attack is over the network and does not require authentication or user interaction.

CISA KEV confirms this issue is real and requires mitigation, with a remediation deadline of 2024-08-05. A public proof-of-concept exists (GitHub PoC), and exploitation has been described via press/incident-style reporting without a clear dated claim in the provided findings.

Affected version condition: GeoServer prior to 2.22.6, 2.23.6, 2.24.4, and 2.25.2. Fixes are available as follows: org.geoserver.web:gs-web-app, org.geoserver:gs-wfs, and org.geoserver:gs-wms are fixed in 2.24.4 (and the vendor remediation set includes 2.25.2), and GeoTools is fixed in 29.6.

If patching is not immediately possible, removing gt-complex-x.y.jar removes the vulnerable code path but may impact functionality or prevent deployment depending on required modules.