Overview

GeoServer is an open-source Java server for sharing geospatial data, widely deployed in government, enterprise, and research environments. CVE-2024-36401 allows an unauthenticated attacker to execute arbitrary OS commands on the host by injecting Java expressions into OGC (Open Geospatial Consortium) filter parameters.

The vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog in July 2024 due to active exploitation in the wild.

Affected Versions

GeoServer versions older than 2.23.0 are also likely affected but are end-of-life and untested.

Technical Details

GeoServer uses the GeoTools library to evaluate OGC filter expressions. The valueReference parameter (and others such as CQL_FILTER) is passed to JXPathContext.selectNodes() from Apache Commons JXPath without sanitisation.

JXPath supports calling arbitrary Java methods through expressions such as:

This evaluation occurs before authentication is checked for certain endpoints, making the vulnerability fully unauthenticated.

Vulnerable endpoints:

• POST /geoserver/wfs — GetPropertyValue request with valueReference
• GET /geoserver/ows — same parameter via query string

Key technical note: The valueReference expression must use single quotes (') around the command string. Double quotes (") cause XML parsing failures and prevent execution — a common pitfall in other public PoCs.

Requirements

• Python 3.9+
• requests library
• Target running a vulnerable GeoServer version with at least one WFS feature type available (default sample data workspaces sf, topp, tiger are sufficient)

Installation

Or install dependencies directly:

Usage

Modes

Examples

1. Reverse Shell (recommended)

Start a listener first:

Then run the exploit:

Expected output:

On the listener:

2. Command Execution (Blind)

Execute a command without receiving output. Useful for out-of-band verification or dropping files:

Note: Commands containing shell metacharacters (>, |, &, ;) are automatically base64-encoded to avoid parsing issues.

3. Specify Feature Type Manually

If auto-detection fails, provide a known feature type from the target:

Common feature types included with GeoServer sample data:

How It Works

The exploit sends a GetPropertyValue WFS request with a malicious valueReference expression:

For the reverse shell, a two-stage approach is used to avoid issues with shell metacharacters inside the exec() single-string argument:

Stage 1 — Write the reverse shell to /tmp/rs.sh using base64 encoding and shell brace expansion (no spaces in the exec string):

Stage 2 — Execute the script:

This approach avoids the need for a shell interpreter in the first exec() call, making it reliable across different system configurations.

Troubleshooting

[-] Cannot connect to target

• Verify the target URL and port are correct
• Confirm GeoServer is running: curl http://<TARGET>:8080/geoserver/web/

[-] No usable feature type found

• GeoServer sample data may not be installed
• Try specifying a custom feature type with -f <workspace>:<type>
• List available types: curl "http://<TARGET>:8080/geoserver/wfs?request=GetCapabilities"

[+] Payload delivered but no shell received

• Confirm your listener is running before sending the exploit
• Check firewall rules — the target must be able to reach your LHOST:LPORT
• Some PoCs use double quotes (") around the command — this does not work. Ensure single quotes (') are used inside the valueReference expression.

[!] Version X.X.X may be patched — attempting anyway

• The script always attempts the exploit regardless of version detection
• Version detection may fail if the About page is restricted; the exploit may still succeed

References

• NVD — CVE-2024-36401
• GitHub Advisory — GHSA-7g64-hx6g-4427
• GeoServer Security Advisory
• CISA KEV Catalog
• GeoTools JXPath Patch

License

This project is licensed under the MIT License. See LICENSE for details.