GeoServer Metasploit exploit module

Recently CVE-2024-36401 was announced that describes a vulnerability in GeoServer. GeoServer is an open-source software server written in Java that provides the ability to view, edit, and share geospatial data. It is designed to be a flexible, efficient solution for distributing geospatial data from a variety of sources such as Geographic Information System (GIS) databases, web-based data, and personal datasets.

Multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.

Affected versions:

>= 2.24.0, < 2.24.4
>= 2.25.0, < 2.25.2
< 2.23.6

I created a Metaspoit module exploit/multi/http/geoserver_unauth_rce_cve_2024_36401 that has been released in main stream of Metasploit.

See also Metasploit-weekly-wrap-up-7-19-2024