CVE-2024-36401

Estado: AnalizadaCrítica (9.8)⚠ Explotación activa

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.

The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions.

Leer descripción completaMostrar menos

This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code.

Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Puntuación base: 9.8

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 100%
Percentil entre todas las CVEs puntuadas: 100
Fecha de la puntuación: 29/9/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

CISA KEV — explotada activamente

Añadida al catálogo: 15/7/2024
Plazo de remediación: 5/8/2024
Uso conocido en ransomware: Unknown

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1190 Exploit Public-Facing Applicationinitial access95 %
Impacto principalT1059.007 JavaScriptexecution95 %
Impacto secundarioT1005 Data from Local Systemcollection70 %

RCE unauthenticated en parámetros OGC públicos (WFS/WMS/WPS) mediante evaluación insegura de XPath en propiedad de features. AV:N, PR:N, ejecución de código arbitrario confirmada en múltiples endpoints.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Vulnerability Scanning Restrict Web-Based Content Privileged Account Management Network Segmentation Limit Access to Resource Over Network Filter Network Traffic

Tecnologías afectadas (2)

Geoserver — Geoserver Geotools — Geotools

CWE

CWE-95
CWE-94

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2024-36401",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-36401",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "active"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-07-13T03:55:17.574252Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 9.8,
          "attackVector": "NETWORK",
          "baseSeverity": "CRITICAL",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 3.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "geoserver",
          "product": "geoserver",
          "versions": [
            {
              "status": "affected",
              "version": ">= 2.23.0, < 2.23.6"
            },
            {
              "status": "affected",
              "version": ">= 2.24.0, < 2.24.4"
            },
            {
              "status": "affected",
              "version": ">= 2.25.0, < 2.25.2"
            },
            {
              "status": "affected",
              "version": "< 2.22.6"
            }
          ]
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*"
          ],
          "vendor": "geoserver",
          "product": "geoserver",
          "versions": [
            {
              "status": "affected",
              "version": "0",
              "lessThan": "2.23.6",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:2.3:a:geoserver:geoserver:2.24.0:-:*:*:*:*:*:*"
          ],
          "vendor": "geoserver",
          "product": "geoserver",
          "versions": [
            {
              "status": "affected",
              "version": "2.24.0",
              "lessThan": "2.24.4",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:2.3:a:geoserver:geoserver:2.25.0:-:*:*:*:*:*:*"
          ],
          "vendor": "geoserver",
          "product": "geoserver",
          "versions": [
            {
              "status": "affected",
              "version": "2.25.0",
              "lessThan": "2.25.2",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2024-07-01T16:15:04.120",
  "references": [
    {
      "url": "https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geotools/geotools/pull/4797",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://osgeo-org.atlassian.net/browse/GEOT-7587",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv",
      "tags": [
        "Mitigation",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/geotools/geotools/pull/4797",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w",
      "tags": [
        "Exploit",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://osgeo-org.atlassian.net/browse/GEOT-7587",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401",
      "tags": [
        "Exploit",
        "Third Party Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36401",
      "tags": [
        "US Government Resource"
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-95"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.\n\nThe GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code.\n\nVersions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed."
    },
    {
      "lang": "es",
      "value": "GeoServer es un servidor de código abierto que permite a los usuarios compartir y editar datos geoespaciales. Antes de las versiones 2.23.6, 2.24.4 y 2.25.2, varios parámetros de solicitud de OGC permitían la ejecución remota de código (RCE) por parte de usuarios no autenticados a través de entradas especialmente diseñadas en una instalación predeterminada de GeoServer debido a la evaluación insegura de nombres de propiedades como expresiones XPath. La API de la librería GeoTools a la que llama GeoServer evalúa los nombres de propiedades/atributos para tipos de entidades de una manera que los pasa de manera insegura a la librería commons-jxpath, que puede ejecutar código arbitrario al evaluar expresiones XPath. Esta evaluación XPath está destinada a ser utilizada únicamente por tipos de funciones complejas (es decir, almacenes de datos de esquemas de aplicación), pero también se aplica incorrectamente a tipos de funciones simples, lo que hace que esta vulnerabilidad se aplique a **TODAS** las instancias de GeoServer. No se proporciona ninguna PoC pública, pero se ha confirmado que esta vulnerabilidad es explotable a través de solicitudes WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic y WPS Execute. Esta vulnerabilidad puede llevar a la ejecución de código arbitrario. Las versiones 2.23.6, 2.24.4 y 2.25.2 contienen un parche para el problema. Existe una workaround eliminando el archivo `gt-complex-xyjar` del GeoServer donde `xy` es la versión de GeoTools (por ejemplo, `gt-complex-31.1.jar` si ejecuta GeoServer 2.25.1). Esto eliminará el código vulnerable de GeoServer, pero puede interrumpir algunas funciones de GeoServer o evitar que GeoServer se implemente si se necesita el módulo gt-complex."
    }
  ],
  "lastModified": "2026-06-17T07:36:38.833",
  "cisaActionDue": "2024-08-05",
  "cisaExploitAdd": "2024-07-15",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BE0EE582-FAE7-4528-9A5E-6E56EB1DE345",
              "versionEndExcluding": "2.22.6"
            },
            {
              "criteria": "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0069EB0E-BF96-47F5-8A02-13F9FA6C15D8",
              "versionEndExcluding": "2.23.6",
              "versionStartIncluding": "2.23.0"
            },
            {
              "criteria": "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6A407E94-A7F2-4A4F-B96E-2B3DC8FF6DF3",
              "versionEndExcluding": "2.24.4",
              "versionStartIncluding": "2.24.0"
            },
            {
              "criteria": "cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CFBAEC7A-6250-45FE-AB54-30D72C03F62D",
              "versionEndExcluding": "2.25.2",
              "versionStartIncluding": "2.25.0"
            },
            {
              "criteria": "cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "732DE428-3515-459F-AE5F-08407BA1A049",
              "versionEndExcluding": "29.6"
            },
            {
              "criteria": "cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5E338785-9877-4731-B095-E40C86D89577",
              "versionEndExcluding": "30.4",
              "versionStartIncluding": "30.1"
            },
            {
              "criteria": "cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "956C1035-1771-4DBE-9B23-815DB6ECB8BF",
              "versionEndExcluding": "31.2",
              "versionStartIncluding": "31.1"
            },
            {
              "criteria": "cpe:2.3:a:geotools:geotools:30.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CCE433A3-886D-4CBB-9696-660F517FBFEE"
            },
            {
              "criteria": "cpe:2.3:a:geotools:geotools:30.0:rc:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CEB40BCD-6D65-4DC8-A0BF-F5736D543B59"
            },
            {
              "criteria": "cpe:2.3:a:geotools:geotools:31.0:-:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "75B1DF89-EFC1-4F5A-881E-495AE00E820B"
            },
            {
              "criteria": "cpe:2.3:a:geotools:geotools:31.0:rc:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "72752A30-52B9-4E95-90F8-A807618B5313"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "OSGeo GeoServer GeoTools Eval Injection Vulnerability"
}