Recent monitoring of global threat activity indicates a resurgence of interest in exploiting GeoServer instances. According to the SANS Internet Storm Center, security researchers have observed a spike in scanning and exploitation attempts targeting CVE-2024-36401. This specific CVE allows for unauthenticated RCE due to the unsafe evaluation of property names in OGC filters as XPath expressions within the GeoTools library. The CVSS score of 9.8 reflects the severity of the flaw, as it requires no user interaction and can be executed over the network.
Technical Analysis of CVE-2024-36401 and Rondo
The vulnerability exists because GeoServer incorrectly handles specific Open Geospatial Consortium (OGC) filter expressions. When an attacker sends a crafted request, the application passes property names to the GeoTools library, which then evaluates them as XPath expressions. This flaw allows an attacker to execute arbitrary code within the context of the GeoServer process.
The current campaign is primarily focused on delivering a variant of the Rondo malware. Rondo is a botnet written in the Go programming language, designed specifically to carry out DDoS attacks. Unlike some older botnets, Rondo is relatively streamlined, focusing on maintaining persistence and awaiting commands from its C2 infrastructure. In the observed logs, the malware often identifies itself via a specific User-Agent string, such as ‘Rondo/1.0’, during the initial infection phase or subsequent communications.
GeoServer RCE Mitigation Guide
To address this threat, the primary recommendation is to update GeoServer to the latest patched versions. The vulnerability was addressed in versions 2.23.6, 2.24.4, and 2.25.2. If immediate patching is not feasible, administrators can mitigate the risk by removing the gt-complex module from the GeoServer installation, although this may impact the functionality of certain complex feature types.
Secondary defensive measures should involve network-level filtering. Since the exploit involves unauthenticated POST or GET requests to endpoints such as /geoserver/wfs, SOC teams should monitor for unusual OGC filter syntax that contains characters associated with XPath evaluation (e.g., brackets, slashes, or specific function calls). Establishing DDoS protection at the edge is also recommended to prevent an infected host from impacting outgoing network bandwidth.
How to Detect CVE-2024-36401 Exploit Attempts
Security professionals can identify potential compromise by searching for specific IoC patterns in web server logs. Defenders should look for requests targeting the WFS, WMS, or WCS services that include property names containing encoded characters or unusual length. Utilizing a SIEM to correlate spikes in ‘Rondo/1.0’ user agents with outbound connections to unknown IP addresses on non-standard ports can provide early warning of an infection.
Furthermore, Rondo botnet DDoS protection strategies should include monitoring for internal hosts generating high volumes of UDP or TCP SYN traffic toward external targets, which is a hallmark of an active botnet node. Because Rondo is compiled in Go, it may exhibit unique memory signatures; analysts can use YARA rules to scan for Go-based malware artifacts within the /tmp directory or other writable paths where the exploit payload typically lands.