GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions
    2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by
    unauthenticated users through specially crafted input against a default GeoServer installation due to
    unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls
    evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-
    jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation
    is intended to be used only by complex feature types (i.e., Application Schema data stores) but is
    incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL**
    GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable
    through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS
    Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6,
    2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar`
    file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running
    GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer
    functionality or prevent GeoServer from deploying if the gt-complex module is needed. (CVE-2024-36401)

The version of OSGeo GeoServer installed on the remote host is affected by a remote code executionvulnerability, as follows:

  - Multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially     crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath     expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types     in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating     XPath expressions.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

GeoServer versions < 2.23.6, 2.24.0 < 2.24.4, 2.25.0 < 2.25.2 are affected by a vulnerability allowing a remote unauthenticated attacker to execute arbitrary code via a specially forged request due to an unsafely evaluating property names as XPath expressions.

ID	Name	Product	Family	Severity
411492	SCA: security update for org.geoserver.web:gs-web-app, org.geoserver:gs-wfs, org.geoserver:gs-wms (GHSA-6jj6-gm7p-fcvv)	Tenable Cloud Security	SCA Checks	critical
411492	SCA: security update for org.geoserver.web:gs-web-app, org.geoserver:gs-wfs, org.geoserver:gs-wms (GHSA-6jj6-gm7p-fcvv)	Tenable Self-Hosted Container Security	SCA Checks	critical
204972	OSGeo GeoServer RCE (CVE-2024-36401)	Nessus	CGI abuses	critical
114394	GeoServer Remote Code Execution	Web App Scanning	Component Vulnerability	critical

Detections

Analytics

CVE-2024-36401

critical

Tenable Plugins

critical

critical

critical

critical