A critical vulnerability tracked as CVE-2024-36401 in OSGeo GeoServer is being actively exploited in the wild and can lead to unauthenticated remote code execution. The issue affects organizations and government agencies that publish geospatial data through GeoServer instances exposed to the internet.
The root cause lies in the way GeoServer and its supporting GeoTools library evaluate certain property names. In default setups, specific parameters are interpreted as XPath expressions, enabling attackers to craft malicious payloads that trigger code execution through the commons-jxpath library.
Multiple service endpoints are impacted. Attackers can target WFS requests such as GetFeature and GetPropertyValue, WMS functions including GetMap, GetFeatureInfo and GetLegendGraphic, as well as WPS Execute operations. Any internet-facing deployment publishing these endpoints is at immediate risk.
Documented incidents show a clear attack chain: initial access via the vulnerability, internal reconnaissance, lateral movement and persistence through web shells. One tool repeatedly observed is China Chopper, valued by adversaries for its simplicity and resilience after service restarts.
Official fixes have been released in GeoServer versions 2.22.6, 2.23.6, 2.24.4 and 2.25.2. Administrators should update without delay and treat any previously exposed instance as potentially compromised.
When patching cannot be completed immediately, a mitigation is to remove the gt-complex x.y.jar file from the deployment. This step reduces the attack surface but may disable required functionality and should be tested first in a staging environment.
Additional defensive measures include restricting access by IP address, enforcing VPN connections, deploying an authenticated reverse proxy and continuously monitoring logs for anomalous WFS, WMS and WPS requests. After remediation, teams must search for web shells, unexpected processes and unusual outbound connections while rotating associated credentials.
