CVE-2024-24749
📋 TL;DR
This vulnerability in GeoServer allows attackers to bypass input validation and read arbitrary classpath resources with specific file extensions when deployed on Windows with Apache Tomcat. If using an embedded data directory (rare in production), it could lead to administrator privilege escalation. Affected are GeoServer deployments on Windows with Apache Tomcat prior to versions 2.23.5 and 2.24.3.
💻 Affected Systems
- GeoServer
- GeoWebCache
📦 What is this software?
Geoserver by Geoserver
Geoserver by Geoserver
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise with administrator privileges if using embedded data directory, allowing attacker control over geospatial data server.
Likely Case
Information disclosure of sensitive classpath resources, potentially exposing configuration files, credentials, or other sensitive data.
If Mitigated
Limited impact with proper external data directory configuration and access controls in place.
🎯 Exploit Status
Exploitation requires specific file extension targeting and Windows path traversal knowledge. No public exploit code identified in references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.23.5 or 2.24.3
Vendor Advisory: https://github.com/geoserver/geoserver/security/advisories/GHSA-jhqx-5v5g-mpf3
Restart Required: Yes
Instructions:
1. Download GeoServer 2.23.5 or 2.24.3 from official sources. 2. Backup current configuration and data. 3. Deploy updated WAR file or install updated version. 4. Restart application server. 5. Verify functionality.
🔧 Temporary Workarounds
Switch to Linux environment
allMigrate GeoServer deployment from Windows to Linux operating system
Change application server to Jetty
windowsReplace Apache Tomcat with Jetty application server
Disable anonymous GeoWebCache access
allRestrict access to GeoWebCache administration and status pages
Configure authentication in web.xml or application security settings
🧯 If You Can't Patch
- Implement strict network segmentation to isolate GeoServer from untrusted networks
- Deploy web application firewall (WAF) with path traversal protection rules
🔍 How to Verify
Check if Vulnerable:
Check GeoServer version via web interface (Settings → About) or examine WAR file version. Verify deployment on Windows with Apache Tomcat.Check Version:
curl -s http://geoserver-host:port/geoserver/web/ | grep -i 'version' or check web interfaceVerify Fix Applied:
Confirm version is 2.23.5 or higher (2.23.x branch) or 2.24.3 or higher (2.24.x branch). Test path traversal attempts return proper error responses.📡 Detection & Monitoring
Log Indicators:
- Unusual requests to GeoWebCache endpoints with path traversal patterns
- Multiple failed attempts to access classpath resources
- Requests for specific file extensions (.properties, .xml, .txt)
Network Indicators:
- HTTP requests containing '../' patterns to GeoServer endpoints
- Unusual traffic to /geoserver/gwc/rest paths
SIEM Query:
source="*geoserver*" AND (uri="*..*" OR uri="*gwc*" OR user_agent="*scanner*")🔗 References
- https://github.com/GeoWebCache/geowebcache/commit/c7f76bd8a1d67c3b986146e7a5e0b14dd64a8fef
- https://github.com/GeoWebCache/geowebcache/pull/1211
- https://github.com/geoserver/geoserver/security/advisories/GHSA-jhqx-5v5g-mpf3
- http://seclists.org/fulldisclosure/2024/Feb/13
- https://github.com/GeoWebCache/geowebcache/commit/c7f76bd8a1d67c3b986146e7a5e0b14dd64a8fef
- https://github.com/GeoWebCache/geowebcache/pull/1211
- https://github.com/geoserver/geoserver/security/advisories/GHSA-jhqx-5v5g-mpf3
