Code Injection in geoserver - CVE-2024-36401
Published: July 15, 2024 / Updated: February 25, 2025
Vulnerability identifier: #VU94353
CSH Severity: Critical
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-36401
CWE-ID: CWE-94
Exploitation vector: Remote access
Exploit availability:
The vulnerability is being exploited in the wild
Vulnerability details
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to improper input validation. A remote attacker can send a specially crafted request and execute arbitrary code on the target system.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
Affected software
geoserver
How to mitigate CVE-2024-36401
Install updates from vendor's website.
geoserver - addressed in versions 2.22.6, 2.23.6, 2.24.4, 2.25.2
Links to Public Exploits and PoC-codes
- Exploit #11168 - CVE-2024-36401 (Exploiter a Vulnerability detection and Exploitation tool for GeoServer Unauthenticated Remote Code Execution CVE-2024-36401.) (February 25, 2025)
- Exploit #10952 - cve-2024-36401-poc (December 6, 2024)
- Exploit #10933 - CVE-2024-36401 (November 29, 2024)
- Exploit #10912 - CVE-2024-36401-WoodpeckerPlugin (November 22, 2024)
- Exploit #10583 - CVE-2024-36401 (October 11, 2024)
- Exploit #10556 - GeoServer-CVE-2024-36401 (October 9, 2024)
- Exploit #10547 - CVE-2024-36401-PoC (September 27, 2024)
- Exploit #10447 - geoexplorer (August 30, 2024)
- Exploit #10275 - CVE-2024-36401 (August 2, 2024)
- Exploit #10248 - CVE-2024-36401 (July 26, 2024)
- Exploit #10230 - CVE-2024-36401 (July 19, 2024)
- Exploit #10213 - Geoserver unauthenticated Remote Code Execution (July 16, 2024)
External References
- https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
- https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w
- https://github.com/geotools/geotools/pull/4797
- https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
- https://osgeo-org.atlassian.net/browse/GEOT-7587