Loading...
Skip to main content
GeekWala

CVE-2024-36404 — Vulnerability in org.geotools.xsd:gt-xsd-core —...

CRITICAL

GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions

Published February 5, 2025Updated February 4, 2026Source: osv

Summary

### Summary Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input. ### Details The following methods pass XPath expressions to the `commons-jxpath` library which can execute arbitrary code and would be a security issue if the XPath expressions are provided by user input. * `org.geotools.appschema.util.XmlXpathUtilites.getXPathValues(NamespaceSupport, String, Document)` * `org.geotools.appschema.util.XmlXpathUtilites.countXPathNodes(NamespaceSupport, String, Document)` * `org.geotools.appschema.util.XmlXpathUtilites.getSingleXPathValue(NamespaceSupport, String, Document)` * `org.geotools.data.complex.expression.FeaturePropertyAccessorFactory.FeaturePropertyAccessor.get(Object, String, Class<T>)` * `org.geotools.data.complex.expression.FeaturePropertyAccessorFactory.FeaturePropertyAccessor.set(Object, String, Object, Class)` * `org.geotools.data.complex.expression.MapPropertyAccessorFactory.new PropertyAccessor() {...}.get(Object, String, Class<T>)` * `org.geotools.xsd.StreamingParser.StreamingParser(Configuration, InputStream, String)` ### PoC The following inputs to StreamingParser will delay the response by five seconds: ``` new org.geotools.xsd.StreamingParser( new org.geotools.filter.v1_0.OGCConfiguration(), new java.io.ByteArrayInputStream("<Filter></Filter>".getBytes()), "java.lang.Thread.sleep(5000)") .parse(); ``` ### Impact This vulnerability can lead to executing arbitrary code. ### Mitigation GeoTools can operate with reduced functionality by removing the `gt-complex` jar from your application. As an example of the impact application schema datastore would not function without the ability to use XPath expressions to query complex content. The SourceForge download page lists drop-in-replacement jars for GeoTools: [31.1](https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1/), [30.3](https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download), [30.2](https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download), [29.2](https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download), [28.2](https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download), [27.5](https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download), [27.4](https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download), [26.7](https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download), [26.4](https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4/), [25.2](https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download), [24.0](https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download). These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications. ### References https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv https://osgeo-org.atlassian.net/browse/GEOT-7587 https://github.com/geotools/geotools/pull/4797 https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852

Advisory Timeline

  • First published February 5, 2025 (614 days ago).
  • Last revised February 4, 2026 — 364 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

Maven
Update org.geotools.xsd:gt-xsd-core to 28.6 or later
<!-- Update pom.xml dependency version to 28.6 for org.geotools.xsd:gt-xsd-core -->
Maven
Update org.geotools:gt-complex to 29.6 or later
<!-- Update pom.xml dependency version to 29.6 for org.geotools:gt-complex -->
Maven
Update org.geotools.xsd:gt-xsd-core to 31.2 or later
<!-- Update pom.xml dependency version to 31.2 for org.geotools.xsd:gt-xsd-core -->
Maven
Update org.geotools:gt-app-schema to 29.6 or later
<!-- Update pom.xml dependency version to 29.6 for org.geotools:gt-app-schema -->
Maven
Update org.geotools:gt-app-schema to 31.2 or later
<!-- Update pom.xml dependency version to 31.2 for org.geotools:gt-app-schema -->
Maven
Update org.geotools.xsd:gt-xsd-core to 29.6 or later
<!-- Update pom.xml dependency version to 29.6 for org.geotools.xsd:gt-xsd-core -->
Maven
Update org.geotools:gt-app-schema to 28.6 or later
<!-- Update pom.xml dependency version to 28.6 for org.geotools:gt-app-schema -->
Maven
Update org.geotools:gt-app-schema to 30.4 or later
<!-- Update pom.xml dependency version to 30.4 for org.geotools:gt-app-schema -->
Maven
Update org.geotools:gt-complex to 31.2 or later
<!-- Update pom.xml dependency version to 31.2 for org.geotools:gt-complex -->
Maven
Update org.geotools:gt-complex to 30.4 or later
<!-- Update pom.xml dependency version to 30.4 for org.geotools:gt-complex -->
Maven
Update org.geotools.xsd:gt-xsd-core to 30.4 or later
<!-- Update pom.xml dependency version to 30.4 for org.geotools.xsd:gt-xsd-core -->
Maven
Update org.geotools:gt-complex to 28.6 or later
<!-- Update pom.xml dependency version to 28.6 for org.geotools:gt-complex -->

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (12)

Affects 1 ecosystem: maven (3).

PackageEcosystemAffectedFixed In
org.geotools.xsd:gt-xsd-core
maven
All versions28.6
org.geotools:gt-complex
maven
All versions29.6
org.geotools.xsd:gt-xsd-core
maven
All versions31.2
org.geotools:gt-app-schema
maven
All versions29.6
org.geotools:gt-app-schema
maven
All versions31.2
org.geotools.xsd:gt-xsd-core
maven
All versions29.6
org.geotools:gt-app-schema
maven
All versions28.6
org.geotools:gt-app-schema
maven
All versions30.4
org.geotools:gt-complex
maven
All versions31.2
org.geotools:gt-complex
maven
All versions30.4
org.geotools.xsd:gt-xsd-core
maven
All versions30.4
org.geotools:gt-complex
maven
All versions28.6

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References

Frequently Asked Questions

What is CVE-2024-36404?
GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
How do I check if my project is affected by CVE-2024-36404?
CVE-2024-36404 affects org.geotools.xsd:gt-xsd-core, org.geotools:gt-complex and org.geotools:gt-app-schema. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2024-36404 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
9.8

Exploitation is straightforward and causes maximum impact. Patch immediately.

Also Known As

GHSA-w3pj-wh35-fq8w

Related CVEs

More Maven advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies