CVE-2024-36401
Published: July 15, 2024
Official Description
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.
CISA KEV Advisory
OSGeo GeoServer GeoTools Eval Injection Vulnerability
OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Risk Analysis
OSGeo GeoServer GeoTools is vulnerable to improper neutralization of directives in dynamically evaluated code, leading to remote code execution. This high-severity flaw, with its high EPSS score and confirmed exploitation, presents a critical risk. Unauthenticated attackers can execute arbitrary code via specially crafted input.
This vulnerability is actively exploited in the wild and is listed in CISA's KEV catalog, confirming its use by threat actors. The flaw allows unauthenticated attackers to achieve remote code execution through specially crafted input, indicating remote exploitability.
OSGeo GeoServer GeoTools users should apply the latest security patches to address this remote code execution vulnerability. Implementing robust input validation and restricting access to the GeoServer instance are also crucial.
Technical Analysis
CVE-2024-36401 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2024-36401 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Exploit & PoC Resources
All References (1)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2024-36401 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1