HackZoneLabs News
Newsletter

CVE-2024-36401

Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

  • Critical 9.8
  • Exploited: added to CISA KEV 15 Jul 2024

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

Key facts

Published
1 Jul 2024
Last changed
21 Oct 2025
Assigned by
GitHub_M
KEV added
15 Jul 2024
KEV fix due
5 Aug 2024
EPSS
99.813% likely to be exploited in the next 30 days, higher than 99.959% of CVEs (scores for 15 Nov 2026)
SSVC (CISA)
Exploitation: active; Automatable: yes; Technical impact: total

Severity scores

Each score is shown as its source gave it. They are not averaged or merged.

  • 9.8CVSS 3.1, Criticalfrom the CNA (GitHub_M)CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

What to do

  • Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.CISA KEV required action

Historical context and remediation

This reference retains the original CVE publication date. A recent record update does not mean a new attack occurred.

No separately sourced impact summary is available on this page yet. Consult the description, version data and dated exploitation evidence.

Version statuses below come from the CNA. An “unaffected” version is not necessarily a currently supported release or proof of a patch date. EPSS is a dated risk estimate, not a count of historical attacks.

Read the original CVE record.

Affected products

VendorProductVersions
geoservergeoserver
  • >= 2.23.0, < 2.23.6 (affected)
  • >= 2.24.0, < 2.24.4 (affected)
  • >= 2.25.0, < 2.25.2 (affected)
  • < 2.22.6 (affected)

Timeline

  1. 1 Jul 2024 Published
  2. 15 Jul 2024 CVE-2024-36401 added to CISA KEV
  3. 15 Jul 2024 Added to the CISA KEV catalogue

Weakness

References