CVE-2024-36401

The GeoTools library, which GeoServer uses, processes property/attribute names of feature types in a way that unsafely passes them to the commons-jxpath library. This library can execute arbitrary code when evaluating XPath expressions. This mechanism was intended exclusively for complex feature types (Application Schema data stores), but is incorrectly applied to simple feature types as well, making the vulnerability affect ALL GeoServer instances. The exploit is possible through requests: WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic, and WPS Execute.

An unauthenticated attacker can execute arbitrary code on the server, which in practice means complete system takeover, data exfiltration, modification of geospatial data, or lateral movement within the network.

GeoServer must be immediately updated to version 2.22.6, 2.23.6, 2.24.4, or 2.25.2 (depending on the branch in use). If an update is not possible immediately, a workaround is available consisting of removing the `gt-complex-x.y.jar` file from the GeoServer installation (e.g., `gt-complex-31.1.jar` for GeoServer 2.25.1) — note: this may limit functionality or prevent GeoServer from starting if the gt-complex module is required.

All default GeoServer installations in versions prior to 2.22.6, 2.23.6, 2.24.4, and 2.25.2, as well as the related GeoTools library (all versions before the patch release).

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

OSGeo GeoServer GeoTools contains an improper neutralization of directives in dynamically evaluated code vulnerability due to unsafely evaluating property names as XPath expressions. This allows unauthenticated attackers to conduct remote code execution via specially crafted input.