GeoServer Remote Code Execution (RCE) Critical Security Advisory (CVE-2024-36401)
Executive & SecOps Summary
SECOPS ASSESSMENTAll default installations of GeoServer prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2
Unauthenticated remote attackers can execute arbitrary system commands on the host server via manipulated OGC request parameters
Immediately upgrade to patched versions (2.22.6, 2.23.6, 2.24.4, 2.25.2 or higher) or apply the workaround by removing the 'gt-complex' JAR file
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
The recommended remediation is to upgrade GeoServer to the patched versions (2.22.6, 2.23.6, 2.24.4, or 2.25.2 and above).
For Docker-based deployments, pull and deploy the latest secure image:
# Example for Docker Compose environments
docker-compose pull geoserver
docker-compose up -d2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, you can mitigate the vulnerability by removing the vulnerable gt-complex JAR file from the GeoServer classpath. Note that this may disable complex feature schema functionalities.
# Navigate to the GeoServer WEB-INF library directory
cd /usr/share/geoserver/webapps/geoserver/WEB-INF/lib/
# Backup and remove the vulnerable gt-complex jar file
mkdir -p /tmp/geoserver-backup
mv gt-complex-*.jar /tmp/geoserver-backup/
# Restart the GeoServer service to apply changes
systemctl restart geoserver3. Log Audit & IoC Verification Commands
Use the following commands to inspect GeoServer logs for potential exploitation attempts and verify the installed library versions.
# Scan GeoServer logs for suspicious JXPath or Java execution patterns
grep -Ei 'jxpath|runtime|processbuilder|exec|class' /var/log/geoserver/*.log
# Verify the presence and version of GeoTools JAR files
find / -name 'gt-api-*.jar' -o -name 'gt-complex-*.jar' 2>/dev/nullBlock Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-36401) exists in GeoServer, an open-source geospatial data sharing server, and stems from an API evaluation flaw within the underlying GeoTools library. When GeoServer processes feature type property/attribute names, it unsafely passes them to the commons-jxpath library without proper sanitization. This allows arbitrary XPath expressions to be evaluated, leading to arbitrary code execution (CWE-95, CWE-94). Although this XPath evaluation was originally designed only for complex feature types (Application Schema data stores), a logic error caused it to be applied to simple feature types as well, rendering ALL default GeoServer instances vulnerable.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated remote attacker can exploit this vulnerability by targeting various OGC (Open Geospatial Consortium) service endpoints. Confirmed attack vectors include WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic, and WPS Execute requests. By injecting a specially crafted XPath expression into the property/attribute name parameters of these requests, the attacker forces the GeoTools API to pass the payload to commons-jxpath. The JXPath engine then parses and executes the malicious expression, resulting in arbitrary Java class execution and system-level command execution.
3. Infrastructure & Business Impact
With a CVSS 3.1 score of 9.8 (Critical), this vulnerability is highly severe and is actively exploited in the wild, as confirmed by its inclusion in the CISA KEV (Known Exploited Vulnerabilities) catalog. The EPSS score of 0.9981 (99.81%) indicates an extremely high probability of exploitation attempts. Successful exploitation grants the attacker full control over the host operating system running GeoServer, potentially leading to lateral movement within the internal network, exfiltration of sensitive GIS databases, ransomware deployment, or unauthorized resource utilization (e.g., cryptomining).
Official Vendor Advisories & References
GeoServer is an open source server that allows users to share and edit geospatial data. Prior to versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions. The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to **ALL** GeoServer instances. No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests. This vulnerability can lead to executing arbitrary code. Versions 2.22.6, 2.23.6, 2.24.4, and 2.25.2 contain a patch for the issue. A workaround exists by removing the `gt-complex-x.y.jar` file from the GeoServer where `x.y` is the GeoTools version (e.g., `gt-complex-31.1.jar` if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed.
Frequently Asked SecOps Questions (CVE-2024-36401)
FAQQ1. How critical is CVE-2024-36401 and is it actively exploited in the wild?
CVE-2024-36401 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.8%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-36401?
Primary impacted vendors include geoserver, geotools across geoserver. Scope summary: All GeoServer versions prior to 2.22.6, 2.23.6, 2.24.4, and 2.25.2
Q3. What temporary mitigations or workarounds exist for CVE-2024-36401 before patching?
[Mitigation] Immediately upgrade to patched versions (2.22.6, 2.23.6, 2.24.4, 2.25.2 or higher) or apply the workaround by removing the 'gt-complex' JAR file Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-36401
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (geoserver)
View Category →Langflow Unauthenticated Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-33017)
[Affected Scope] Langflow versions prior to 1.9.0
IBM Langflow OSS Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-9198)
[Affected Scope] IBM Langflow OSS versions 1.0.0 through 1.10.0 in default deployments
Microsoft SharePoint Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-65660)
[Affected Scope] Microsoft SharePoint Server 2016, 2019, and Subscription Edition.
Apache ActiveMQ Jolokia JMX-HTTP Bridge Remote Code Execution Vulnerability Advisory (CVE-2026-34197)
[Affected Scope] Apache ActiveMQ Classic versions prior to 5.19.4, and 6.0.0 through 6.2.3
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.