CVE-2024-36401

OSGeo GeoServer GeoTools Eval Injection Vulnerability

Geoserver

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way…

1. Jul 2024

Ausgewertete Quellen

• Hersteller
  https://osgeo-org.atlassian.net/browse/GEOT-7587
• Hinweis
  https://www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36401
• CISA
  OSGeo GeoServer GeoTools Eval Injection Vulnerability
• NVD
  CVE-2024-36401
• GitHub
  https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852
• GitHub
  https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
• GitHub
  https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w