CVE-2024-36401: Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver

Published Jul 1, 2024
·
Updated

Summary Multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.

Details The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to ALL GeoServer instances.

PoC No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests.

Impact This vulnerability can lead to executing arbitrary code.

Workaround

A workaround exists by removing the gt-complex-x.y.jar file from the GeoServer where x.y is the GeoTools version (e.g., gt-complex-31.1.jar if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed by an extension you are using:

Mitigation for geoserver.war deploy:

1. Stop the application server 2. Unzip geoserver.war into a directory 3. Locate the file WEB-INF/lib/gt-complex-x.y.jar and remove 4. Zip the directory into a new geoserver.war 5. Restart the application server

Mitigation for GeoServer binary:

1. Stop Jetty 2. Locate the file webapps/geoserver/WEB-INF/lib/gt-complex-x.y.jar and remove 3. Restart Jetty

The following extensions and community modules are known to have a direct dependency on gt-complex jar and are not expected function properly without it. This is not comprehensive list and additional GeoServer functionality may be dependent on the availability of gt-complex jar: Extensions: Application Schema, Catalog Services for the Web, MongoDB Data Store Community Modules: Features-Templating, OGC API Modules, Smart Data Loader, SOLR Data Store

Mitigation available for prior releases patching three jars in your existing install:

1. Patched gt-app-schema, gt-complex and gt-xsd-core jars may be downloaded for GeoServer: 2.25.1, 2.24.3, 2.24.2, 2.23.2, 2.22.2, 2.21.5, 2.21.4,2.20.7, 2.20.4, 2.19.2, 2.18.0. As example the 2.25.1 page links to geoserver-2.25.1-patches.zip download on source forge.

2. Unzip the geoserver-x.y.z-patches.zip which contains three jars that have been patched to configure commons-jxpath with an empty function list prior to use. These files are drop-in replacements with identical file names to those they are replacing.

3. Follow the instructions above to locate WEB-INF/lib folder and replace the existing gt-app-schema, gt-complex and gt-xsd-core jars with those supplied by the patch.

References https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w https://osgeo-org.atlassian.net/browse/GEOT-7587 https://github.com/geotools/geotools/pull/4797 https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852

Other sources

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.

The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to ALL GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code.

Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the gt-complex-x.y.jar file from the GeoServer where x.y is the GeoTools version (e.g., gt-complex-31.1.jar if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

— MITRE

OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.

— CISA

Affected Software

24 affected componentsFixes available
maven/org.geoserver:gs-wms<2.22.6
2.22.6
maven/org.geoserver:gs-wfs<2.22.6
2.22.6
maven/org.geoserver.web:gs-web-app<2.22.6
2.22.6
maven/org.geoserver:gs-wms>=2.23.0<2.23.6
2.23.6
maven/org.geoserver:gs-wfs>=2.23.0<2.23.6
2.23.6
maven/org.geoserver.web:gs-web-app>=2.23.0<2.23.6
2.23.6
maven/org.geoserver:gs-wms>=2.25.0<2.25.2
2.25.2
maven/org.geoserver:gs-wfs>=2.25.0<2.25.2
2.25.2
maven/org.geoserver.web:gs-web-app>=2.25.0<2.25.2
2.25.2
maven/org.geoserver:gs-wms>=2.24.0<2.24.4
2.24.4
maven/org.geoserver:gs-wfs>=2.24.0<2.24.4
2.24.4
maven/org.geoserver.web:gs-web-app>=2.24.0<2.24.4
2.24.4
OSGeo GeoServer
GeoServer geoserver<2.22.6
GeoServer geoserver>=2.23.0<2.23.6
GeoServer geoserver>=2.24.0<2.24.4
GeoServer geoserver>=2.25.0<2.25.2
GeoTools GeoTools<29.6
GeoTools GeoTools>=30.1<30.4
GeoTools GeoTools>=31.1<31.2
GeoTools GeoTools=30.0
GeoTools GeoTools=30.0-rc
GeoTools GeoTools=31.0
GeoTools GeoTools=31.0-rc

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade maven/org.geoserver:gs-wms to a version that resolves this vulnerability.

    Fixed in 2.22.6
  2. Upgrade

    Upgrade maven/org.geoserver:gs-wfs to a version that resolves this vulnerability.

    Fixed in 2.22.6
  3. Upgrade

    Upgrade maven/org.geoserver.web:gs-web-app to a version that resolves this vulnerability.

    Fixed in 2.22.6
  4. Upgrade

    Upgrade maven/org.geoserver:gs-wms to a version that resolves this vulnerability.

    Fixed in 2.23.6
  5. Upgrade

    Upgrade maven/org.geoserver:gs-wfs to a version that resolves this vulnerability.

    Fixed in 2.23.6
  6. Upgrade

    Upgrade maven/org.geoserver.web:gs-web-app to a version that resolves this vulnerability.

    Fixed in 2.23.6
  7. Upgrade

    Upgrade maven/org.geoserver:gs-wms to a version that resolves this vulnerability.

    Fixed in 2.25.2
  8. Upgrade

    Upgrade maven/org.geoserver:gs-wfs to a version that resolves this vulnerability.

    Fixed in 2.25.2
  9. Upgrade

    Upgrade maven/org.geoserver.web:gs-web-app to a version that resolves this vulnerability.

    Fixed in 2.25.2
  10. Upgrade

    Upgrade maven/org.geoserver:gs-wms to a version that resolves this vulnerability.

    Fixed in 2.24.4
  11. Upgrade

    Upgrade maven/org.geoserver:gs-wfs to a version that resolves this vulnerability.

    Fixed in 2.24.4
  12. Upgrade

    Upgrade maven/org.geoserver.web:gs-web-app to a version that resolves this vulnerability.

    Fixed in 2.24.4
  13. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.25.1Patch geoserver-2.25.1-patches.zip
  14. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.24.3Patch geoserver-2.24.3-patches.zip
  15. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.24.2Patch geoserver-2.24.2-patches.zip
  16. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.23.2Patch geoserver-2.23.2-patches.zip
  17. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.22.2Patch geoserver-2.22.2-patches.zip
  18. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.21.5Patch geoserver-2.21.5-patches.zip
  19. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.21.4Patch geoserver-2.21.4-patches.zip
  20. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.20.7Patch geoserver-2.20.7-patches.zip
  21. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.20.4Patch geoserver-2.20.4-patches.zip
  22. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.19.2Patch geoserver-2.19.2-patches.zip
  23. Upgrade

    Upgrade GeoServer (patched GeoTools jars: gt-app-schema, gt-complex, gt-xsd-core) to a version that resolves this vulnerability.

    Fixed in 2.18.0Patch geoserver-2.18.0-patches.zip
  24. Remove

    Remove geoserver/WEB-INF/lib/gt-complex-x.y.jar from your environment.

    In the GeoServer install, locate and remove the file `WEB-INF/lib/gt-complex-x.y.jar` (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1).

  25. Remove

    Remove geoserver/webapps/geoserver/WEB-INF/lib/gt-complex-x.y.jar from your environment.

    In the GeoServer install, locate and remove the file `webapps/geoserver/WEB-INF/lib/gt-complex-x.y.jar`.

  26. Configuration

    Using the provided `geoserver-x.y.z-patches.zip`, unzip `geoserver.war` into a directory, replace the existing `gt-app-schema`, `gt-complex` and `gt-xsd-core` jars in `WEB-INF/lib` with the patched ones, then re-zip the directory into a new `geoserver.war`. This patch configures `commons-jxpath` with an empty function list prior to use.

    GeoServer (repacked geoserver.war using patch jars) commons-jxpath function list = empty function list prior to use
  27. Operational

    Restart the application server (the material explicitly mentions stopping/restarting Jetty/application server) after applying the patched/removed `gt-complex`/replacement jars.

Event History

Jul 1, 2024
CVE Published
via MITRE·03:25 PM
Data Sourced
via MITRE·03:25 PM
DescriptionSeverityWeakness
Data Sourced
via NVD·04:15 PM
RemedyDescriptionSeverityWeaknessAffected Software
Advisory Published
via GitHub·08:34 PM
Jul 15, 2024
Known Exploited
via CISA·12:00 AM
Jul 16, 2024
News Published
via BleepingComputer·10:14 PM
News Published
via BleepingComputer·10:16 PM
Sep 23, 2025
News Published
via BleepingComputer·03:07 PM
Dec 12, 2025
News Published
via BleepingComputer·09:48 AM
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2024-36401?

CVE-2024-36401 has been classified as a critical vulnerability due to its potential for remote code execution by unauthenticated users.

2

How do I fix CVE-2024-36401?

To mitigate CVE-2024-36401, update GeoServer to version 2.23.6 or later.

3

Which versions are affected by CVE-2024-36401?

CVE-2024-36401 affects GeoServer versions prior to 2.23.6 and versions between 2.24.0 and 2.24.4, as well as versions between 2.25.0 and 2.25.2.

4

What type of attack does CVE-2024-36401 enable?

CVE-2024-36401 enables remote code execution through specially crafted input against a default GeoServer installation.

5

Who can exploit CVE-2024-36401?

CVE-2024-36401 can be exploited by unauthenticated users, making it particularly dangerous.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203