Remote Code Execution (RCE) vulnerability in evaluating property name expressions in Geoserver (CVE-2024-36401)

What is affected, what to do

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.

The vulnerability is being actively exploited; treat it as a priority. Update OSGeo GeoServer to version 2.22.6. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• OSGeo GeoServer gte 2.23.0, < 2.23.6..*
• OSGeo GeoServer lt *..2.22.6

Fixed in

• OSGeo GeoServer 2.22.6

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Patch GeoServer to a fixed release immediately: 2.22.6, 2.23.6, 2.24.4, or 2.25.2 depending on your branch. If GeoTools is deployed standalone, update to 29.6 or 30.4.
   • As an interim workaround, delete the gt-complex-x.y.jar from the GeoServer lib directory (e.g. gt-complex-31.1.jar for GeoServer 2.25.1) and restart the service. Expect Application-Schema datastores to break — this is intentional, the vulnerable code path is removed.
   • Pull every internet-facing GeoServer (typically TCP/8080, often fronted on 80/443 via reverse proxy) behind VPN or authentication until the patch is validated. Public OGC endpoints are the primary attack surface.
   • Launch a compromise assessment: look at process ancestry of the Java/Tomcat PID (java → sh/bash/cmd/powershell), new cron entries, fresh SSH keys under the GeoServer service account, outbound connections to unknown IPs since June 2024.
   • Rotate the GeoServer service account credentials, database credentials in datastore.xml, and any cloud IAM keys available on the host, if the instance was exposed before patching.
   • Take a forensic snapshot before patching so IoC hunting remains possible if indicators surface later.
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: restrict OGC endpoints (/geoserver/ows, /geoserver/wfs, /geoserver/wms, /geoserver/wps) to defined source networks. Front internet exposure with a read-only reverse proxy that filters requests.
   • WAF / reverse-proxy rule: block or alert on GetPropertyValue, GetFeature, GetMap, GetFeatureInfo, GetLegendGraphic, Execute requests where valueReference, propertyName, or CQL_FILTER contains exec(, Runtime, ProcessBuilder, java.lang, getRuntime, jxpath, or .getClass(.
   • Endpoint hardening: run the Java process under a minimally privileged service account (no root, no Local Admin). Enforce a SecurityManager or an AppArmor/SELinux profile that denies process spawning from the JVM context.
   • Egress filtering: allow outbound only to known databases and update mirrors. Deny arbitrary outbound (DNS, HTTP, raw TCP to the internet) — typical payloads stage second-stage tooling.
   • IAM hygiene: expose the admin UI (/geoserver/web/) only through a management VLAN or bastion. Audit for default admin/geoserver credentials and replace them — even though this CVE is unauth, it makes post-RCE lateral movement harder.
   • Suricata/Snort: deploy vendor-published signatures for CVE-2024-36401 (ET OPEN has released SIDs); add a generic rule matching exec(Runtime.getRuntime()) or jxpath strings inside OGC request URIs or bodies.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: hunt GET/POST to /geoserver/ows, /geoserver/wfs, /geoserver/wms with query parameters containing exec(, Runtime.getRuntime, ProcessBuilder, java.lang., Expression., system-properties. KQL shape: WebLogs | where url_path has "geoserver" and (query has_any ("exec(", "Runtime", "ProcessBuilder", "jxpath")).
   • Sysmon EID 1 / Linux auditd execve: child processes of the Java/Tomcat PID that are shells, curl, wget, nc, powershell, whoami, id. Sigma shape: parent_image endswith "java.exe" or "java" and image endswith any of those — extremely atypical in a GeoServer deployment.
   • Netflow/Zeek: outbound connections from the GeoServer host to new external IPs on ports 4444, 1337, 8888, or HTTP downloads of .sh/.elf/.jar within seconds of an inbound OGC request. Correlate request timestamp to egress within a 10-second window.
   • Filesystem monitoring on the web root plus /tmp, /var/tmp, C:\Windows\Temp: new executables, webshells (.jsp, .war), or cron entries created by the GeoServer service account.
   • EDR behavioural rule: Java process invoking fork/exec into a shell with base64-decoded payloads or unusually long argument lists — a standard TTP in the RCE chains against this CVE.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

Source: NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), pwn.watch, OSV (Open Source Vulnerabilities), cvelistv5

Vendors and products

• GeoServer OSGeo GeoServer
• Geotools Geotools

Weakness classes (CWE)

• CWE-95Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')

  Variant

  The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes code syntax before using the input in a dynamic evaluation call (e.g. "eval").

  Entry at MITRE CWE-95

References & sources

• github.comgeoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvvweb, x_refsource_CONFIRM, Mitigation, Vendor advisory
• github.comgeotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8wweb, x_refsource_MISC, Exploit, Vendor advisory
• NVD (NIST)NVD: CVE-2024-36401advisory, pwn-watch
• github.comgeotools/geotools/pull/4797web, x_refsource_MISC, Issue tracking, Patch, pwn-watch
• github.comWarxim/CVE-2022-41852?tab=readme-ov-fileweb, x_refsource_MISC, Exploit, Third-party advisory
• github.comgeoserver/geoserverpackage
• osgeo-org.atlassian.netbrowse/GEOT-7587web, x_refsource_MISC, Vendor advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36401web, government-resource, US government resource
• vicarius.iovsociety/posts/geoserver-rce-cve-2024-36401web, Exploit, Third-party advisory
• pwn.watchpwn.watch: OSGeo GeoServer GeoTools Eval Injectionpwn-watch
• github.comOSGeo advisory: CVE-2024-36401pwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch