critical CVSS 9.8 Actively exploited EPSS 100%

CVE-2024-36401·Geoserver vulnerability

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

Severity
critical
Software
Geoserver
Fixed in
31.2
Published

How Defensia detected this

Defensia agents read the web server logs of the Linux servers they protect and match incoming requests against exploitation signatures. When the same CVE is matched across enough independent servers, from enough distinct networks, it is recorded as being actively exploited. That threshold was crossed for CVE-2024-36401 starting , across 4.2% of the servers Defensia monitors, from 7 distinct attacking IP addresses.

Every CVE we currently measure under active exploitation is listed together, with the share of servers targeted and how long each has been running.

Where the attacks came from

US · 29CA · 7TR · 2AD · 1

Aggregated across every server Defensia monitors, over 6 days of observation, last measured . Counts are of distinct servers and distinct source addresses, not of requests. No customer, host or domain is identified.

How likely is exploitation

FIRST's Exploit Prediction Scoring System puts the probability of this CVE being exploited in the next 30 days at 100% — among the highest-scoring CVEs ever published. EPSS is an independent forecast of exploitation, not a severity rating: it says nothing about how much damage a successful attack does, which is what a CVSS score measures.

Affected versions

From: 31.1

Until: 31.2

Fixed in: 31.2

How to fix this CVE

Upgrade GeoServer to version 2.25.2 or later (2.24.4, 2.23.6, or 2.22.6 for older branches) to patch the XPath injection vulnerability in OGC request parameter handling. This critical flaw allows unauthenticated remote code execution through WFS, WMS, and WPS endpoints by exploiting unsafe evaluation of feature property names. If immediate patching is not possible, remove the gt-complex JAR file from your GeoServer installation as a temporary mitigation, though this may affect Application Schema functionality.

sudo dnf update geoserver

Defensia detects this vulnerability

What an exploitation attempt looks like

Sample log line indicative of exploitation attempts:

WFS|WMS|WPS request with crafted property/attribute names containing XPath metacharacters or expressions such as: (//|@|\[|\]|=|exec|java\.lang|runtime|process) in GetFeature, GetPropertyValue, GetMap, GetFeatureInfo, GetLegendGraphic, or Execute parameters

WAF mitigation (if patching is not yet possible)

Add this rule to your WAF to block exploitation attempts while you schedule the patch. 

Deploy WAF rules to block OGC requests (WFS, WMS, WPS) containing XPath injection patterns: block requests where parameter values include XPath operators (//,@,[,],=) or Java reflection keywords (exec, Runtime, ProcessBuilder, getRuntime). Alternatively, restrict unauthenticated access to /geoserver/ows, /geoserver/wfs, /geoserver/wms, and /geoserver/wps endpoints to known trusted clients only.

How to check if you are affected

  1. Check GeoServer version: Log in to the GeoServer web console (typically http://localhost:8080/geoserver/) and navigate to 'About GeoServer' to verify the installed version
  2. Verify vulnerable endpoints are exposed: Test if WFS, WMS, and WPS services are enabled by accessing http://{geoserver-host}:8080/geoserver/web/wicket/resource/org.geoserver.web.GeoServerBasePage/pageTitle-en_US.properties
  3. Search application logs for suspicious OGC request patterns: grep -i 'GetFeature\|GetPropertyValue\|GetMap\|GetFeatureInfo\|GetLegendGraphic\|Execute' /var/log/geoserver/geoserver.log | grep -E '(xpath|expression|exec)' to identify potential exploitation attempts
  4. Confirm patch application: After upgrading, verify the new version by checking the About page and confirm that gt-complex JAR is present and updated in the GeoServer lib directory

FAQ

What is CVE-2024-36401?

CVE-2024-36401 is a critical remote code execution vulnerability in GeoServer that allows unauthenticated attackers to execute arbitrary code by injecting malicious XPath expressions through OGC request parameters (WFS, WMS, WPS). The vulnerability exists because property names are unsafely evaluated as XPath expressions by the commons-jxpath library, affecting all GeoServer installations regardless of feature type configuration.

Is CVE-2024-36401 being actively exploited?

No public proof-of-concept exploit has been released, and CVE-2024-36401 is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog. However, given its critical CVSS score of 9.8 and ease of exploitation against default installations, organizations should prioritize patching immediately.

What versions of Geoserver are affected by CVE-2024-36401?

GeoServer versions prior to 2.22.6, 2.23.6, 2.24.4, and 2.25.2 are vulnerable. Specifically, GeoTools versions 31.1 through 31.2 contain the vulnerable gt-complex component. All GeoServer instances using these versions are at risk, including those with simple feature types.

How do I check if my server is vulnerable to CVE-2024-36401?

Access your GeoServer web console at http://{hostname}:8080/geoserver/ and click 'About GeoServer' to view the version number. If running version 2.25.1 or earlier (outside the patched versions), your installation is vulnerable. You can also check the geoserver.war/WEB-INF/lib/ directory for gt-complex JAR files to confirm the vulnerable component is present.

Does Defensia detect CVE-2024-36401?

Yes — Defensia's CVE advisory scanner compares installed package versions against the NVD database. If GeoServer is installed on a monitored server, CVE-2024-36401 will appear in your dashboard with remediation steps.

References

Track CVEs across your fleet automatically

Defensia scans your Linux servers and tells you exactly which ones are running vulnerable versions — including CVE-2024-36401. Free for 1 server.

Get started free