Pierluigi Paganini
July 16, 2024
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added an OSGeo GeoServer GeoTools eval injection vulnerability, tracked as CVE-2024-36401 (CVSS score of 9.8), to its Known Exploited Vulnerabilities (KEV) catalog.
GeoServer is an open-source server that allows users to share and edit geospatial data.
GeoServer versions prior to 2.23.6, 2.24.4, and 2.25.2 are vulnerable to Remote Code Execution (RCE) due to unsafe evaluation of property names as XPath expressions. This issue arises because the GeoTools library API, which GeoServer uses, evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library, allowing arbitrary code execution. The vulnerability impacts all GeoServer instances, as it incorrectly applies XPath evaluation to simple feature types. An attacker can exploit the vulnerability through various requests such as WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic, and WPS Execute requests. The vulnerability has been addressed in versions 2.23.6, 2.24.4, and 2.25. The advisory also provides a workaround that consists of removing the gt-complex-x.y.jar file from GeoServer, where x.y represents the GeoTools version, though this may break some functionality or prevent deployment if the module is needed.
According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, FCEB agencies have to address the identified vulnerabilities by the due date to protect their networks against attacks exploiting the flaws in the catalog.
Experts recommend also private organizations review the Catalog and address the vulnerabilities in their infrastructure.
CISA orders federal agencies to fix this vulnerability by August 5, 2024.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, US CISA Known Exploited Vulnerabilities catalog)
