## https://sploitus.com/exploit?id=93EFFA1D-01DF-57C9-9826-139DBF9FD985
# CVE-2024-36401 โ Unauthenticated RCE in GeoServer
A complete, reproducible study of **CVE-2024-36401**, an unauthenticated remote code
execution flaw in [GeoServer](https://geoserver.org/) โ the most widely deployed
open-source server for geospatial data. The bug is an *eval injection*: through the
parameters of the OGC standards, GeoServer hands attacker-controlled *property names*
to GeoTools, where Apache Commons **JXPath** evaluates them as XPath expressions and,
by design, can call arbitrary Java methods via reflection. An unauthenticated request
such as `exec(java.lang.Runtime.getRuntime(),'id')` therefore runs commands on the host.
This repo contains the technical report, a working exploit/verifier, and a one-command
Docker environment that demonstrates the RCE on a **vulnerable** instance and shows the
**same exploit failing** on the patched one.
> **Educational project.** Built for a university course (Data Privacy and Security,
> LUISS DASMA). Everything runs only against local, isolated containers โ see
> [Responsible use](#responsible-use).
## At a glance
| Field | Value |
|---|---|
| CVE (GeoServer) | CVE-2024-36401 |
| Root cause (GeoTools) | CVE-2024-36404 |
| Type | Unauthenticated Remote Code Execution |
| CWE | CWE-95, Eval Injection |
| CVSS v3.1 | 9.8 Critical (`AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H`) |
| Affected | GeoServer ')`
creates a file inside the container, verifiable with `docker exec`.
On the vulnerable instance, sending the payload by hand returns a `ClassCastException` on
`ProcessImpl` โ the JVM ran `Runtime.exec` and then failed to use the resulting `Process`
object as an attribute. That exception **is** the proof of execution:
## The fix
GeoTools commit [`e53e5170`](https://github.com/geotools/geotools/pull/4797) (in GeoServer
2.25.2, 2.24.4, 2.23.6, 2.22.6) applies *defence in depth* on both halves of the bug:
- **Sink:** a `JXPathUtils.newSafeContext(...)` helper installs an **empty** `FunctionLibrary`,
so JXPath can no longer resolve `exec`/`Thread.sleep` as functions โ the string stays a
plain property name.
- **Scope:** `FeaturePropertyAccessorFactory` now also checks `SimpleFeatureType`, so simple
features no longer reach the vulnerable accessor.
On the patched instance the same payload returns `No such attribute: ...` and nothing runs.
Full details โ affected code with file/line references, exploitation, mitigation diff, and
the side-by-side reproduction โ are in **[`report/report.pdf`](report/report.pdf)**.
## Responsible use
This CVE is public, has been patched for over 18 months, sits in the CISA Known Exploited
Vulnerabilities catalogue, and has public PoCs (Vulhub, Nuclei, Metasploit). The code here
targets **only `localhost`** and the isolated study containers in this repository. Do not use
it against systems you do not own or are not explicitly authorised to test.
## License
[MIT](LICENSE) ยฉ 2026 Daniele Giovanardi
## Author
**Daniele Giovanardi** โ Data Science and Management (DASMA), LUISS Guido Carli.
Coursework for *Data Privacy and Security*.