GeoServer CVE-2024-36401 (unauthenticated remote code execution via OGC request parameters / property name evaluation, CISA KEV): fixed versions and workaround?

What it is: CVE-2024-36401 is a code injection flaw in GeoServer (through GeoTools) where property names in OGC requests are unsafely evaluated as XPath expressions via the commons-jxpath library. An unauthenticated user can reach it through WFS, WMS and WPS requests, and the advisory says it affects all GeoServer instances. It was published July 1, 2024, rated 9.8, and added to CISA's KEV catalog on July 15, 2024 after exploitation. Am I affected: - GeoServer before 2.22.6, 2.23.0 to before 2.23.6, 2.24.0 to before 2.24.4, and 2.25.0 to before 2.25.2. NVD also lists affected GeoTools ranges for embedded use. - Check the version on the GeoServer welcome or About page, or in the WAR/Docker image tag. Fix: 1. Upgrade to GeoServer 2.22.6, 2.23.6, 2.24.4 or 2.25.2, or to a current release. 2. If you cannot upgrade right away, the advisory's workaround is to remove the gt-complex jar (gt-complex-x.y.jar, x.y being your GeoTools version) from WEB-INF/lib. That may break extensions that depend on it, such as Application Schema, CSW or MongoDB data stores, so test first. For older releases the advisory also describes replacing specific GeoTools jars with patched ones. 3. Do not expose GeoServer directly to the internet when avoidable; use a reverse proxy and restrict administration. 4. If an unpatched instance was internet-facing, look for unexpected processes, files and outbound connections from the GeoServer host, review request logs for anomalous OGC requests, rebuild from a clean image, and rotate data store, database and admin credentials. Verify: the version is a fixed release (or gt-complex is removed as a stopgap) and the instance is not needlessly exposed. Sources: https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv https://nvd.nist.gov/vuln/detail/CVE-2024-36401 https://www.cisa.gov/known-exploited-vulnerabilities-catalog