CVE-2024-36401

CVE-2024-36401 is a critical remote code execution vulnerability discovered in GeoServer and GeoTools, both open source software used to distribute geospatial data. The flaw in the software design or implementation was first reported on Security Boulevard in July 2024. It was one of two vulnerabilities identified (along with CVE-2024-36404), posing a significant threat due to the potential for malicious actors to execute arbitrary code on vulnerable systems remotely. The vulnerability was subsequently exploited by threat actors, as reported by Fortinet FortiGuard Labs. Various malware families, including cryptocurrency miners, bots, and the SideWalk backdoor, were delivered through this exploit. The US Cybersecurity & Infrastructure Security Agency (CISA) added this bug to its known exploited vulnerabilities catalog, highlighting the seriousness of the issue. By September 2024, the cybersecurity firm Trend Micro revealed that a group dubbed Earth Baxia had been using the CVE-2024-36401 vulnerability in their attacks. Earth Baxia, suspected to originate from China, targeted government organizations in Taiwan and other Asia-Pacific countries. Their methods included spear-phishing emails and exploiting the aforementioned vulnerability in GeoServer software to deliver a remote code execution exploit.