Outbreak Alert: GeoServer RCE Attack
| Description | This outbreak alert on GeoServer covers vulnerability that is CVE-2024-36401.
CVE-2024-36401 is a critical vulnerability affecting GeoServer, an open-source server for sharing geospatial data. It arises from an insecure manner in which the GeoTools library API, utilized by GeoServer, passes attribute names of element types to the commons-jxpath library. This vulnerability, identified as a Remote Code Execution (RCE) flaw, enables attackers to execute arbitrary code on the affected systems. GeoServer versions prior to 2.25.2, 2.24.4, and 2.23.6 are vulnerable.
This article describes the assessment of Remote Code Execution vulnerability in GeoServer software. |
| Scope | FortiDAST Scripting Engine updated in version 24.3.a |
| Solution | Detection against that vulnerability is empowered by the FortiDAST Scripting Engine (FSE).
This technology enables FortiDAST to assess remotely with a high level of confidence if an asset is vulnerable to a specific vulnerability by testing the disarmed exploit against the asset itself.
To configure the scan, it will be necessary to enable the FSE group signature 'geoserver' which will select the underlying script as per the scan requirement: 'CVE-2024-36401 GeoServer unauthenticated RCE Vulnerability.'
For reference, a step-by-step guide on how to configure FortiDAST to trigger FSE can be found on Fortinet’s blog: |
