CISA: Patch Critical GeoServer GeoTools Bug Now
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-36401 | Unauthenticated RCE in OSGeo GeoServer via GeoTools XPath Injection OSGeo GeoServer ships the GeoTools library, which evaluates feature property names directly as XPath expressions without proper neutralization (CWE-95), so attacker-supplied input is executed as code rather than treated as data. A remote, unauthenticated attacker triggers the flaw by sending specially crafted requests to a GeoServer service, causing the injected expression to be evaluated in the server's context. Successful exploitation results in remote code execution on the host running GeoServer, giving the attacker control over the mapping server and any data or credentials it can reach. Any organization running GeoServer is affected, and the underlying GeoTools flaw also extends to dependent applications such as GeoNetwork, which shipped its own fix for an unauthenticated RCE chain affecting government geoportal backends. The flaw is being actively exploited: it was added to CISA KEV on 2024-07-15, and EPSS assigns a 99.8% probability of exploitation within 30 days. Do: Upgrade GeoServer to the fixed releases identified in the OSGeo advisory (2.23.6, 2.24.4 or 2.25.2, or later); where upgrading is not immediately possible, restrict access to GeoServer's public endpoints per vendor mitigations or discontinue use of the product per the KEV required action. Organizations running GeoNetwork or other GeoTools-based applications should apply those vendors' fixes as well. Given active exploitation, hunt for signs of compromise such as unexpected child processes spawned by the GeoServer Java process, new files or services on the host, and unusual map/feature service request patterns. | 9.8 | 100% | KEV PoC ×3 |
| largeTens of thousands of internet-exposed instances (roughly 20,000-40,000 GeoServer endpoints visible in public internet scans), with substantially more internal… |
Full article342 words · extracted from infosecurity-magazine.com · click to collapse
The US Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal government agencies to patch a critical vulnerability in a popular open source server that’s being actively exploited in the wild.
CISA added CVE-2024-36401 to its Known Exploited Vulnerabilities (KEV) catalog earlier this week, ordering agencies to patch by August 5.
The remote code execution (RCE) vulnerability is found in the GeoTools plugin of GeoServer, an open source server written in Java that allows users to share, process and edit geospatial data.
“OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions,” CISA said. “This allows unauthenticated attackers to conduct remote code execution via specially crafted input.”
Read more on open source vulnerabilities: Apache Warns of Critical Vulnerability in Struts 2
While it’s unclear who is exploiting the vulnerability and how, GeoServer maintainers patched it in versions 2.23.6, 2.24.4 and 2.25.2, which users are urged to upgrade to.
They also offered workarounds to remove the vulnerable code from GeoServer but warned that they “may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed by an extension you are using.”
At the time, the maintainers claimed: “No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests.”
However, proof-of-concept code soon began circulating online, around a fortnight ago.
Non-profit the Shadowserver Foundation claimed in a social media post to have first observed signs of exploitation of CVE-2024-36401 back on July 9. It urged users to “check for signs of compromise and patch.”
— The Shadowserver Foundation (@Shadowserver) July 16, 2024CISA added GeoServer CVE-2024-36401 to its Known Exploited Vulnerability Catalog https://t.co/0jvga7TBFr
We first observed CVE-2024-36401 "POST /geoserver/wfs" exploitation July 9th in our sensors. Check for signs of compromise & patch https://t.co/CTcIZzwtsI
While all civilian federal government agencies must follow the CISA KEV catalog deadline, it is recommended best practice that private enterprises follow suit.
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/cisa-patch-critical-geoserver/