CVE-2024-36401

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*
cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*
cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*

History

21 Nov 2024, 09:22

Type Values Removed Values Added
References
  • () https://www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401 -
References () https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852 - Exploit, Third Party Advisory () https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852 - Exploit, Third Party Advisory
References () https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv - Mitigation, Vendor Advisory () https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv - Mitigation, Vendor Advisory
References () https://github.com/geotools/geotools/pull/4797 - Issue Tracking, Patch () https://github.com/geotools/geotools/pull/4797 - Issue Tracking, Patch
References () https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w - Exploit, Vendor Advisory () https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w - Exploit, Vendor Advisory
References () https://osgeo-org.atlassian.net/browse/GEOT-7587 - Vendor Advisory () https://osgeo-org.atlassian.net/browse/GEOT-7587 - Vendor Advisory

03 Jul 2024, 15:07

Type Values Removed Values Added
CWE CWE-94
References () https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852 - () https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852 - Exploit, Third Party Advisory
References () https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv - () https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv - Mitigation, Vendor Advisory
References () https://github.com/geotools/geotools/pull/4797 - () https://github.com/geotools/geotools/pull/4797 - Issue Tracking, Patch
References () https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w - () https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w - Exploit, Vendor Advisory
References () https://osgeo-org.atlassian.net/browse/GEOT-7587 - () https://osgeo-org.atlassian.net/browse/GEOT-7587 - Vendor Advisory
CPE cpe:2.3:a:geoserver:geoserver:*:*:*:*:*:*:*:*
cpe:2.3:a:geotools:geotools:*:*:*:*:*:*:*:*
Summary
  • (es) GeoServer es un servidor de código abierto que permite a los usuarios compartir y editar datos geoespaciales. Antes de las versiones 2.23.6, 2.24.4 y 2.25.2, varios parámetros de solicitud de OGC permitían la ejecución remota de código (RCE) por parte de usuarios no autenticados a través de entradas especialmente diseñadas en una instalación predeterminada de GeoServer debido a la evaluación insegura de nombres de propiedades como expresiones XPath. La API de la librería GeoTools a la que llama GeoServer evalúa los nombres de propiedades/atributos para tipos de entidades de una manera que los pasa de manera insegura a la librería commons-jxpath, que puede ejecutar código arbitrario al evaluar expresiones XPath. Esta evaluación XPath está destinada a ser utilizada únicamente por tipos de funciones complejas (es decir, almacenes de datos de esquemas de aplicación), pero también se aplica incorrectamente a tipos de funciones simples, lo que hace que esta vulnerabilidad se aplique a **TODAS** las instancias de GeoServer. No se proporciona ninguna PoC pública, pero se ha confirmado que esta vulnerabilidad es explotable a través de solicitudes WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic y WPS Execute. Esta vulnerabilidad puede llevar a la ejecución de código arbitrario. Las versiones 2.23.6, 2.24.4 y 2.25.2 contienen un parche para el problema. Existe una workaround eliminando el archivo `gt-complex-xyjar` del GeoServer donde `xy` es la versión de GeoTools (por ejemplo, `gt-complex-31.1.jar` si ejecuta GeoServer 2.25.1). Esto eliminará el código vulnerable de GeoServer, pero puede interrumpir algunas funciones de GeoServer o evitar que GeoServer se implemente si se necesita el módulo gt-complex.
First Time Geotools geotools
Geoserver
Geoserver geoserver
Geotools

01 Jul 2024, 16:15

Type Values Removed Values Added
New CVE

Information

Published : 2024-07-01 16:15

Updated : 2024-11-21 09:22


NVD link : CVE-2024-36401

Mitre link : CVE-2024-36401

CVE.ORG link : CVE-2024-36401


JSON object : View

Products Affected

geotools

  • geotools

geoserver

  • geoserver
CWE
CWE-95

Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

CWE-94

Improper Control of Generation of Code ('Code Injection')