CVE-2024-36401: 
Java vulnerability analysis and mitigation

GeoServer versions prior to 2.23.6, 2.24.4, and 2.25.2 contain a critical remote code execution vulnerability (CVE-2024-36401) with a CVSS score of 9.8. The vulnerability allows unauthenticated users to execute arbitrary code through specially crafted input against a default GeoServer installation. The issue stems from the GeoTools library API that GeoServer uses to evaluate property/attribute names for feature types in an unsafe manner when processing XPath expressions (Fortinet, GitHub Advisory).

The vulnerability exists in the way GeoTools library API evaluates property/attribute names for feature types by unsafely passing them to the commons-jxpath library, which can execute arbitrary code when evaluating XPath expressions. While this XPath evaluation was intended only for complex feature types (Application Schema data stores), it is incorrectly applied to simple feature types as well, making all GeoServer instances vulnerable. The vulnerability can be exploited through multiple OGC request parameters including WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests (GitHub Advisory).

The vulnerability enables remote attackers to gain control of vulnerable systems and execute arbitrary code with the privileges of the GeoServer application. Successful exploitation has been observed targeting IT service providers in India, technology companies in the U.S., government entities in Belgium, and telecommunications companies in Thailand and Brazil. Attackers have used this vulnerability to deploy various malware including cryptocurrency miners, botnet malware like Condi and JenX, and backdoors such as SideWalk (Fortinet, The Hacker News).

The vulnerability has been patched in GeoServer versions 2.23.6, 2.24.4, and 2.25.2. A temporary workaround exists by removing the gt-complex-x.y.jar file from the GeoServer installation, though this may break some functionality. For prior releases, patched gt-app-schema, gt-complex and gt-xsd-core jars are available for download. The developer patched the vulnerability by implementing the function 'JXPathUtils.newSafeContext' instead of the original vulnerable one to evaluate XPath expression safety (GitHub Advisory, Fortinet).