GeoTools is a widely used open-source Java library for managing and processing geospatial data. This critical vulnerability (CVE-2024-36404) poses a serious security risk to applications and systems that utilize it. Exploitation of this vulnerability can allow remote attackers to compromise servers, leading to significant organizational and operational impacts. With over 34,215 instances exposed globally, immediate action is required to mitigate the risk.

Technical Summary

The vulnerability resides in a GeoTools feature that evaluates XPath expressions derived from user input. In affected versions, insufficient input sanitization allows an attacker to inject and execute malicious XPath expressions, leading to Remote Code Execution (RCE).

Technical Details:

• Impact: Remote attackers can execute arbitrary commands on the server, enabling data theft, ransomware deployment, or lateral movement within networks.
• Vulnerable Component: The vulnerability specifically affects applications using the gt-complex module for querying complex content via XPath.
• Affected Versions: GeoTools versions prior to 31.2, 30.4, and 29.6.
• Mitigation:
  1. Update to the patched versions: 31.2, 30.4, or 29.6.
  2. Remove the gt-complex jar, although this will disable features such as complex content querying in datastore.
  3. Alternatively, replace GeoTools with the patched jars available on SourceForge for specific older versions.

Recommendations

To mitigate this vulnerability:

1. Update GeoTools to the latest patched versions (31.2, 30.4, or 29.6).
2. For environments where an immediate update is not possible, implement the following workarounds:
   • Remove the gt-complex jar to reduce functionality.
   • Use patched GeoTools jars available on SourceForge for older versions, ensuring their integrity is validated before deployment.

[Callforaction-THREAT-Footer]