SonicWall Capture Labs researchers identified a critical remote code execution vulnerability (CVE-2024-36401) in GeoServer prior to fixed versions, allowing unauthenticated attackers to run arbitrary code remotely. Mitigations include upgrading to the latest versions or removing the vulnerable GeoTools library from affected deployments. #GeoServer #CVE-2024-36401 #GeoTools #SonicWall
Keypoints
- Vulnerability Identified: CVE-2024-36401 in GeoServer.
- Impact: Critical CVSS score of 9.8 enabling remote code execution.
- Affected Versions: GeoServer versions before 2.24.4, 2.25.2, and 2.23.6.
- Exploitation Method: Leveraging OGC request parameters such as WFS and WMS.
- Mitigation: Upgrade to the latest versions or remove the vulnerable GeoTools library file.
- SonicWall Protections: New IPS signatures released to protect against exploitation.
MITRE Techniques
- [T1203] Remote Code Execution – Remote code execution through crafted OGC requests. “Remote code execution through crafted OGC requests.”
- [T1203] Exploitation for Client Execution – Exploiting vulnerabilities in GeoServer to execute arbitrary code. “Exploiting vulnerabilities in GeoServer to execute arbitrary code.”
- [T1071] Command and Control – Using network access to send malicious requests to the server. “Using network access to send malicious requests to the server.”
Indicators of Compromise
- [File] gt-complex-x.y.jar – WEB-INF/lib/gt-complex-x.y.jar, webapps/geoserver/WEB-INF/lib/gt-complex-x.y.jar
- [File] poc2 – /tmp/poc2
- [Domain] geoserver.org – GeoServer official site referenced in the article
- [Domain] blog.sonicwall.com – Source of the original post