All vulnerabilities
CVE-2024-36401GHSA-6jj6-gm7p-fcvvGHSA-w3pj-wh35-fq8w

OSGeo GeoServer GeoTools Eval Injection Vulnerability

OSGeo GeoServerMavenApplications & CMS
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationExploited in the wildAdded to KEV 15 Jul 2024CISA KEV
Exploit odds (EPSS)99.8%Chance of exploitation activity in the next 30 days, higher than 99.9% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2.24.4Also 2.25.2, 2.23.6 and 1 moreOSV
Federal deadline5 Aug 2024Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

  • 2.24.4org.geoserver.web:gs-web-app, MavenOSV<dependency><groupId>org.geoserver.web</groupId><artifactId>gs-web-app</artifactId><version>2.24.4</version></dependency>
  • 2.24.4org.geoserver:gs-wfs, MavenOSV<dependency><groupId>org.geoserver</groupId><artifactId>gs-wfs</artifactId><version>2.24.4</version></dependency>
  • 2.24.4org.geoserver:gs-wms, MavenOSV<dependency><groupId>org.geoserver</groupId><artifactId>gs-wms</artifactId><version>2.24.4</version></dependency>
  • 2.25.2org.geoserver.web:gs-web-app, MavenOSV<dependency><groupId>org.geoserver.web</groupId><artifactId>gs-web-app</artifactId><version>2.25.2</version></dependency>
  • 2.25.2org.geoserver:gs-wfs, MavenOSV<dependency><groupId>org.geoserver</groupId><artifactId>gs-wfs</artifactId><version>2.25.2</version></dependency>
  • 2.25.2org.geoserver:gs-wms, MavenOSV<dependency><groupId>org.geoserver</groupId><artifactId>gs-wms</artifactId><version>2.25.2</version></dependency>
Show all 12 fixed versions
  • 2.23.6org.geoserver.web:gs-web-app, MavenOSV<dependency><groupId>org.geoserver.web</groupId><artifactId>gs-web-app</artifactId><version>2.23.6</version></dependency>
  • 2.23.6org.geoserver:gs-wfs, MavenOSV<dependency><groupId>org.geoserver</groupId><artifactId>gs-wfs</artifactId><version>2.23.6</version></dependency>
  • 2.23.6org.geoserver:gs-wms, MavenOSV<dependency><groupId>org.geoserver</groupId><artifactId>gs-wms</artifactId><version>2.23.6</version></dependency>
  • 2.22.6org.geoserver.web:gs-web-app, MavenOSV<dependency><groupId>org.geoserver.web</groupId><artifactId>gs-web-app</artifactId><version>2.22.6</version></dependency>
  • 2.22.6org.geoserver:gs-wfs, MavenOSV<dependency><groupId>org.geoserver</groupId><artifactId>gs-wfs</artifactId><version>2.22.6</version></dependency>
  • 2.22.6org.geoserver:gs-wms, MavenOSV<dependency><groupId>org.geoserver</groupId><artifactId>gs-wms</artifactId><version>2.22.6</version></dependency>

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 1 Jul 2024Exploit code publicMetasploit
  2. 1 Jul 2024, 15:25 UTCPublishedCVE List
  3. 15 Jul 2024Added to CISA KEVCISA KEV

Public exploit code and templates 2

  • Exploit moduleGeoserver unauthenticated Remote Code Execution 1 Jul 2024Metasploit
  • Scanner templateGeoServer RCE in Evaluating Property Name ExpressionsNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.

Text from CVE List

Affected versions 16

  • geoserveraffected: >= 2.23.0, < 2.23.6CVE List
  • geoserveraffected: >= 2.24.0, < 2.24.4CVE List
  • geoserveraffected: >= 2.25.0, < 2.25.2CVE List
  • geoserveraffected: < 2.22.6CVE List
  • org.geoserver.web:gs-web-app, Mavenfrom 2.24.0, fixed in 2.24.4OSV
  • org.geoserver:gs-wfs, Mavenfrom 2.24.0, fixed in 2.24.4OSV
  • org.geoserver:gs-wms, Mavenfrom 2.24.0, fixed in 2.24.4OSV
  • org.geoserver.web:gs-web-app, Mavenfrom 2.25.0, fixed in 2.25.2OSV
  • org.geoserver:gs-wfs, Mavenfrom 2.25.0, fixed in 2.25.2OSV
  • org.geoserver:gs-wms, Mavenfrom 2.25.0, fixed in 2.25.2OSV
  • org.geoserver.web:gs-web-app, Mavenfrom 2.23.0, fixed in 2.23.6OSV
  • org.geoserver:gs-wfs, Mavenfrom 2.23.0, fixed in 2.23.6OSV
  • org.geoserver:gs-wms, Mavenfrom 2.23.0, fixed in 2.23.6OSV
  • org.geoserver.web:gs-web-app, Mavenfrom first release, fixed in 2.22.6OSV
  • org.geoserver:gs-wfs, Mavenfrom first release, fixed in 2.22.6OSV
  • org.geoserver:gs-wms, Mavenfrom first release, fixed in 2.22.6OSV

References 8