CVE-2024-36401: GeoServer — Remote Code Execution Risk (June 2024)

CVE-2024-36401 — GeoServer

CVE-2024-36401 is a high-severity vulnerability in GeoServer that allows remote code execution through improper X-Path expression evaluation. This flaw is under active exploitation by the Rondo botnet, which is using it to deploy malware payloads on unpatched systems. No CVSS score is published, but exploitation in the wild is confirmed.

Attack Vector

Attackers exploit the X-Path evaluation flaw in GeoServer by sending crafted requests that trigger remote command execution. In observed incidents, the attacker used this vector to download and execute a malicious payload from http://45.153.34.153/rondo.``zyt.sh, establishing botnet control. Successful exploitation requires a vulnerable, internet-exposed GeoServer instance.

Who Is at Risk

All organizations running vulnerable versions of GeoServer are at risk, regardless of region or sector. The attack is global in scope and targets any internet-accessible GeoServer deployment. No specific victim organizations are named, but active exploitation is confirmed in the wild.

Patch & Mitigate

• Patch: Upgrade GeoServer to the latest version immediately. Check the vendor’s advisory for specific fixed releases and apply without delay.
• Workaround: Restrict external access to GeoServer endpoints and disable unnecessary features that process X-Path expressions if patching is delayed.
• Detect: Review server logs for unusual X-Path requests and outbound connections to suspicious IPs, especially http://45.153.34.153. Monitor for execution of unknown shell scripts (e.g., zyt.sh).

MITRE ATT&CK

• TA0001 — Initial Access: Attackers exploit the GeoServer vulnerability to gain a foothold.
• TA0002 — Execution: Malicious payloads are executed via remote commands enabled by the X-Path flaw.

Source: https://isc.sans.edu/diary/rss/33176