CVE-2024-36401

GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.

• CWE-95
• CWE-94

• https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852Exploit, Third Party Advisory
• https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvvMitigation, Vendor Advisory
• https://github.com/geotools/geotools/pull/4797Issue Tracking, Patch
• https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8wExploit, Vendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOT-7587Vendor Advisory
• https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852Exploit, Third Party Advisory
• https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvvMitigation, Vendor Advisory
• https://github.com/geotools/geotools/pull/4797Issue Tracking, Patch
• https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8wExploit, Vendor Advisory
• https://osgeo-org.atlassian.net/browse/GEOT-7587Vendor Advisory
• https://www.vicarius.io/vsociety/posts/geoserver-rce-cve-2024-36401Exploit, Third Party Advisory
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-36401US Government Resource

Published

Jul 1, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-36396Verint - CWE-434: Unrestricted Upload of File with Dangerous…8.8
• CVE-2024-36397Vantiva - MediaAccess DGA2232 v19.4 - CWE-79: Improper Neutr…6.1
• CVE-2024-36398A vulnerability has been identified in SINEC NMS (All versio…7.8
• CVE-2024-36399Kanboard is project management software that focuses on the …6.3
• CVE-2024-3640An unquoted executable path exists in the Rockwell Automatio…7
• CVE-2024-36400nano-id is a unique string ID generator for Rust. Affected v…9.8
• CVE-2024-36402Matrix Media Repo (MMR) is a highly configurable multi-homes…5.3
• CVE-2024-36403Matrix Media Repo (MMR) is a highly configurable multi-homes…7.5
• CVE-2024-36404GeoTools is an open source Java library that provides tools …9.8
• CVE-2024-36405liboqs is a C-language cryptographic library that provides i…7.5
• CVE-2024-36406SuiteCRM is an open-source Customer Relationship Management …5.4
• CVE-2024-36407SuiteCRM is an open-source Customer Relationship Management …6.5