September 9, 2024 By Pierluigi Paganini
Multiple threat actors actively exploited the recently disclosed OSGeo GeoServer GeoTools flaw CVE-2024-36401 in malware-based campaigns.
Researchers at Fortinet FortiGuard Labs reported that threat actors exploited the recently disclosed OSGeo GeoServer GeoTools flaw (CVE-2024-36401) to deliver various malware families, including cryptocurrency miners, bots, and the SideWalk backdoor.
GeoServer is an open-source server that allows users to share and edit geospatial data.
GeoServer versions prior to 2.23.6, 2.24.4, and 2.25.2 are vulnerable to Remote Code Execution (RCE) due to unsafe evaluation of property names as XPath expressions. This issue arises because the GeoTools library API, which GeoServer uses, evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library, allowing arbitrary code execution. The vulnerability impacts all GeoServer instances, as it incorrectly applies XPath evaluation to simple feature types. An attacker can exploit the vulnerability through various requests such as WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic, and WPS Execute requests. The vulnerability has been addressed in versions 2.23.6, 2.24.4, and 2.25.
