CVE-2024-45747: 
Java vulnerability analysis and mitigation

CVE-2024-45747 is a Server-Side Template Injection (SSTI) vulnerability in GeoServer's FreeMarker template processing engine. It allows an authenticated administrator to upload malicious FreeMarker templates that can execute arbitrary OS commands and read or write arbitrary files on the server. The vulnerability affects the core GeoServer packages (org.geoserver.web:gs-web-app, org.geoserver:gs-main, and org.geoserver:gs-wms) in all versions prior to 2.27.0, and was published as a security advisory on June 11, 2026. It carries a CVSS v3.1 base score of 7.2 (High) (GitHub Advisory, GeoServer Advisory).

The root cause is classified as CWE-749 (Exposed Dangerous Method or Function). The org.geoserver.template.TemplateUtils.getSafeConfiguration() method attempts to block access to the dangerous freemarker.template.utility.Execute class, but this restriction can be bypassed by chaining a specific sequence of method calls that ultimately grants access to Execute and other sensitive functionality. The vulnerability is exploitable over the network by any authenticated GeoServer administrator who can upload custom FreeMarker templates used in WMS GetFeatureInfo (HTML/JSON) and WMS GetMap (KML/GeoRSS) output formats — features present in a plain GeoServer instance without any extensions or community modules. The fix was developed in pull request #8164 and merged into the main branch on February 7, 2025 (GitHub Advisory, GeoServer PR).

Successful exploitation allows an authenticated administrator to achieve full remote code execution on the GeoServer host, executing arbitrary OS commands with the privileges of the GeoServer process. Additionally, the attacker can read sensitive files (e.g., configuration files, credentials, private keys) or write arbitrary files to the server filesystem, potentially enabling persistence mechanisms such as web shells. The combination of code execution and unrestricted file access creates significant risk for lateral movement within the hosting environment and complete compromise of the server (GitHub Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (GitHub Advisory). Exploitation requires high privileges (administrator-level access to GeoServer), which limits the attack surface compared to unauthenticated vulnerabilities. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No EPSS score or threat actor attribution is currently available.

1. Gain Administrator Access: Obtain valid GeoServer administrator credentials through phishing, credential stuffing, or reuse of default credentials (e.g., admin/geoserver).
2. Navigate to Template Management: Log into the GeoServer web admin interface and navigate to the section that allows uploading or editing FreeMarker templates used for WMS GetFeatureInfo or WMS GetMap output formats.
3. Craft Malicious Template: Create a FreeMarker template that bypasses the getSafeConfiguration() block by chaining a specific sequence of method calls to gain access to freemarker.template.utility.Execute or equivalent dangerous functionality.
4. Inject OS Command Payload: Embed a payload within the template that invokes OS command execution, for example using the Execute class to run a reverse shell or exfiltrate sensitive files.
5. Trigger Template Rendering: Issue a WMS GetFeatureInfo (HTML/JSON) or WMS GetMap (KML/GeoRSS) request that causes GeoServer to render the malicious template, triggering the injected payload on the server.
6. Achieve Objective: Collect command output, establish persistence (e.g., write a web shell), or pivot to other internal systems using the server's network access (GitHub Advisory, GeoServer Advisory).

• Logs: GeoServer access logs showing administrator logins followed by template upload or modification requests; unexpected WMS GetFeatureInfo or GetMap requests that trigger errors related to FreeMarker template evaluation.
• File System: New or modified FreeMarker template files (.ftl) in the GeoServer data directory containing unusual Java class references (e.g., freemarker.template.utility.Execute) or OS command strings; unexpected new files (web shells, scripts) written to the GeoServer web root or data directory.
• Process: Unusual child processes spawned by the GeoServer JVM process (e.g., /bin/sh, cmd.exe, curl, wget, python, nc) indicating OS command execution.
• Network: Unexpected outbound connections from the GeoServer host to external IPs, particularly on non-standard ports, following WMS requests; DNS lookups for unknown external domains originating from the GeoServer process.

Upgrade to GeoServer 2.27.0 or later, which introduces three new application properties — GEOSERVER_FREEMARKER_BLOCK_LIST, GEOSERVER_FREEMARKER_ALLOW_LIST, and GEOSERVER_FREEMARKER_API_EXPOSED — that default to restricting the objects and methods accessible within FreeMarker templates. As an interim measure, restrict GeoServer administrative access to trusted users only and audit any recently uploaded or modified FreeMarker templates for suspicious content. Network-level controls (e.g., firewall rules limiting access to the GeoServer admin interface) can further reduce exposure (GitHub Advisory, GeoServer Advisory).