CVE-2024-36401
Expert Analysis
Professional remediation guidance
Get tailored security recommendations from our analyst team for CVE-2024-36401. We'll provide specific mitigation strategies based on your environment and risk profile.
CVSS Score
V3.1EPSS Score
v2025.03.14There is a 94.4% chance that this vulnerability will be exploited in the wild within the next 30 days.
Attack Vector Metrics
Impact Metrics
Description
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.
The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code.
Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.
Available Exploits
GeoServer RCE in Evaluating Property Name Expressions
In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.
Related News
Affected Products
Affected Versions:
Known Exploited Vulnerability
This vulnerability is actively being exploited in the wild
Remediation Status
Due Date
Added to KEV
Required Action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected Product
Ransomware Risk
GitHub Security Advisories
Community-driven vulnerability intelligence from GitHub
Remote Code Execution (RCE) vulnerability in geoserver
GHSA-6jj6-gm7p-fcvvAdvisory Details
Affected Packages
CVSS Scoring
CVSS Score
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Advisory provided by GitHub Security Advisory Database. Published: July 1, 2024, Modified: March 19, 2025
Social Media Intelligence
Real-time discussions and threat intelligence from social platforms
🔥 Top 10 Trending CVEs (25/08/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-54253](https://nvd.nist.gov/vuln/detail/CVE-2025-54253)** - 📝 Adobe Experience Manager versions 6.5.23 and earlier are affected by a Misconfiguration vulnerability that could result in arbitrary code execution. An attacker could leverage this vulnerability to bypass …
🔥 Top 10 Trending CVEs (24/08/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-50864](https://nvd.nist.gov/vuln/detail/CVE-2025-50864)** - 📝 An Origin Validation Error in the elysia-cors library thru 1.3.0 allows attackers to bypass Cross-Origin Resource Sharing (CORS) restrictions. The library incorrectly validates the supplied origin by checking …
Cybercriminals Exploit GeoServer Flaw for Cryptomining Attacks **Date:** 23-Aug-25 Recent reports highlight a critical vulnerability in GeoServer software, tracked as CVE-2024-36401, which cybercriminals are actively exploiting to deploy cryptomining malware and create IoT botnets. This vulnerability enables remote code execution, allowing attackers to install miners like XMRig on both cloud …
🔥 Top 10 Trending CVEs (23/08/2025) Here’s a quick breakdown of the 10 most interesting vulnerabilities trending today: **1. [CVE-2025-9074](https://nvd.nist.gov/vuln/detail/CVE-2025-9074)** - 📝 A vulnerability was identified in Docker Desktop that allows local running Linux containers to access the Docker Engine API via the configured Docker subnet, at 192.168.65.7:2375 by default. …
Emerging Threats: GeoServer Exploits and New Botnets Challenge Cybersecurity **Recent campaigns leverage known vulnerabilities in GeoServer and IoT devices, exposing systems to exploitation and generating passive income for attackers.** **Key Points:** - CVE-2024-36401 exploits allow attackers to monetize victims' bandwidth stealthily. - The PolarEdge botnet, accumulating 40,000 devices, reflects a …
GeoServer Exploits, PolarEdge, and Gayfemboy Push Cybercrime Beyond Traditional Botnets Cybersecurity researchers are calling attention to multiple campaigns that leverage known security vulnerabilities and expose Redis servers to various malicious activities, including leveraging the compromised devices as IoT botnets,... **CVEs:** CVE-2024-36401 **Source:** https://thehackernews.com/2025/08/geoserver-exploits-polaredge-and.html
CVE-2024-36401 Exploited in Stealthy Bandwidth-Monetization Campaign By CyberDudeBivash — Global Cybersecurity & AI Threat Intelligence Network CyberDudeBivash — Your Global Cybersecurity Shield # Executive Summary A newly discovered exploitation campaign has weaponized **CVE-2024-36401**, a critical vulnerability now being actively used by cybercriminal groups. Unlike traditional ransomware or crypto-mining attacks, this …
Your Connection, Their Cash: Threat Actors Misuse SDKs to Sell Your Bandwidth A campaign leverages CVE-2024-36401 to stealthily monetize victims' bandwidth where legitimate software development kits (SDKs) are deployed for passive income. The post Your Connection, Their Cash: Threat Actors Misuse SDKs to Sell Your... **CVEs:** CVE-2024-36401 **Source:** https://unit42.paloaltonetworks.com/attackers-sell-your-bandwidth-using-sdks/