GeoServer 0-Day Vulnerability Enables Remote Code Execution Attacks

Published August 15, 2026 CVE-2024-36401

A newly found flaw in GeoServer lets attackers send fake location data to your server and, in some cases, run commands on it. This affects organizations that share maps or location data online.

Severity
CriticalCVSS 3.1 · 9.8
Fix
Update available
Affected versions
2.23.0 or newer, but before 2.23.6; 2.24.0 or newer, but before 2.24.4; 2.25.0 or newer, but before 2.25.2+1 more
Weakness
CWE-95
Exploit likelihood
100% in 30 daysEPSS, higher than 100% of known flaws
Affects
GeoServer
Exploited
Yes, in the wildListed by CISA
Added to CISA list
Jul 15, 2024
Federal fix deadline
Aug 5, 2024

How it works

An attacker sends fake location data to GeoServer's map-sharing service, tricking it into running harmful database commands that can crash the service or, in rare cases, run commands on the server itself.

What to do

Check whether the installed GeoServer version is older than the fixed version in the vendor advisory or current release.

Update GeoServer through its normal update channel, then confirm the installed version matches the newest vendor release.

Technical details

A newly disclosed zero-day vulnerability in GeoServer (CVE-2024-36401) allows unauthenticated attackers to inject SQL commands into database queries via the jsonArrayContains function. If GeoServer connects to a Microsoft SQL Server with elevated database privileges, this can escalate to remote code execution on the underlying server, enabling full system compromise. Researcher q1uf3ng disclosed the flaw on August 12, 2024, noting that exploitation attempts were observed shortly after public disclosure.

The risk depends on database configuration, as attackers must first identify vulnerable instances before escalating to command execution. No vendor patch or CVE identifier existed at the time of disclosure.

Severity breakdown

  • Attack vector Network Requires network access to the vulnerable service
  • Attack complexity Low Low complexity under the assessed conditions
  • Privileges required None Attacker needs no account or login
  • User interaction None No victim action needed
  • Scope Unchanged Impact stays within the same security authority
  • Confidentiality impact High Sensitive data can be exposed with serious impact
  • Integrity impact High Protected data can be changed with serious impact
  • Availability impact High The service can stop or suffer serious disruption
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Open in FIRST.org calculator

References

View Original Source