{"id":"GHSA-w3pj-wh35-fq8w","summary":"GeoTools Remote Code Execution (RCE) vulnerability in evaluating XPath expressions","details":"### Summary\nRemote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input.\n\n### Details\nThe following methods pass XPath expressions to the `commons-jxpath` library which can execute arbitrary code and would be a security issue if the XPath expressions are provided by user input.\n\n* `org.geotools.appschema.util.XmlXpathUtilites.getXPathValues(NamespaceSupport, String, Document)`\n* `org.geotools.appschema.util.XmlXpathUtilites.countXPathNodes(NamespaceSupport, String, Document)`\n* `org.geotools.appschema.util.XmlXpathUtilites.getSingleXPathValue(NamespaceSupport, String, Document)`\n* `org.geotools.data.complex.expression.FeaturePropertyAccessorFactory.FeaturePropertyAccessor.get(Object, String, Class\u003cT\u003e)`\n* `org.geotools.data.complex.expression.FeaturePropertyAccessorFactory.FeaturePropertyAccessor.set(Object, String, Object, Class)`\n* `org.geotools.data.complex.expression.MapPropertyAccessorFactory.new PropertyAccessor() {...}.get(Object, String, Class\u003cT\u003e)`\n* `org.geotools.xsd.StreamingParser.StreamingParser(Configuration, InputStream, String)`\n\n### PoC\nThe following inputs to StreamingParser will delay the response by five seconds:\n```\n        new org.geotools.xsd.StreamingParser(\n                        new org.geotools.filter.v1_0.OGCConfiguration(),\n                        new java.io.ByteArrayInputStream(\"\u003cFilter\u003e\u003c/Filter\u003e\".getBytes()),\n                        \"java.lang.Thread.sleep(5000)\")\n                .parse();\n```\n\n### Impact\n\nThis vulnerability can lead to executing arbitrary code.\n\n### Mitigation\n\nGeoTools can operate with reduced functionality by removing the `gt-complex` jar from your application.  As an example of the impact application schema datastore would not function without the ability to use XPath expressions to query complex content.\n\nThe SourceForge download page lists drop-in-replacement jars for GeoTools: [31.1](https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1/), [30.3](https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download), [30.2](https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download), [29.2](https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download), [28.2](https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download), [27.5](https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download), [27.4](https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download), [26.7](https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download), [26.4](https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4/), [25.2](https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download), [24.0](https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download). These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.\n\n### References\nhttps://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv\nhttps://osgeo-org.atlassian.net/browse/GEOT-7587\nhttps://github.com/geotools/geotools/pull/4797\nhttps://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852","aliases":["CVE-2024-36404"],"modified":"2026-01-30T00:31:03.800951Z","published":"2025-02-05T15:32:02Z","related":["CVE-2024-36401"],"database_specific":{"nvd_published_at":"2024-07-02T14:15:13Z","cwe_ids":["CWE-95"],"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2025-02-05T15:32:02Z"},"references":[{"type":"WEB","url":"https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-36404"},{"type":"WEB","url":"https://github.com/geotools/geotools/pull/4797"},{"type":"WEB","url":"https://github.com/geotools/geotools/commit/f0c9961dc4d40c5acfce2169fab92805738de5ea"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2031%20Releases/31.1"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.3/geotools-30.3-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2030%20Releases/30.2/geotools-30.2-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2029%20Releases/29.2/geotools-29.2-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2028%20Releases/28.2/geotools-28.2-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.5/geotools-27.5-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2027%20Releases/27.4/geotools-27.4-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.7/geotools-26.7-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2026%20Releases/26.4"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2025%20Releases/25.2/geotools-25.2-patches.zip/download"},{"type":"WEB","url":"https://sourceforge.net/projects/geotools/files/GeoTools%2024%20Releases/24.0/geotools-24.0-patches.zip/download"},{"type":"WEB","url":"https://osgeo-org.atlassian.net/browse/GEOT-7587"},{"type":"PACKAGE","url":"https://github.com/geotools/geotools"},{"type":"WEB","url":"https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852"}],"affected":[{"package":{"name":"org.geotools:gt-app-schema","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-app-schema"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.0"},{"fixed":"30.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools:gt-complex","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-complex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.0"},{"fixed":"30.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools.xsd:gt-xsd-core","ecosystem":"Maven","purl":"pkg:maven/org.geotools.xsd/gt-xsd-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"30.0"},{"fixed":"30.4"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools:gt-app-schema","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-app-schema"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.0"},{"fixed":"31.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools:gt-complex","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-complex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.0"},{"fixed":"31.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools.xsd:gt-xsd-core","ecosystem":"Maven","purl":"pkg:maven/org.geotools.xsd/gt-xsd-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"31.0"},{"fixed":"31.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools:gt-app-schema","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-app-schema"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0"},{"fixed":"29.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools:gt-complex","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-complex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0"},{"fixed":"29.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools.xsd:gt-xsd-core","ecosystem":"Maven","purl":"pkg:maven/org.geotools.xsd/gt-xsd-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"29.0"},{"fixed":"29.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools:gt-app-schema","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-app-schema"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools:gt-complex","ecosystem":"Maven","purl":"pkg:maven/org.geotools/gt-complex"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}},{"package":{"name":"org.geotools.xsd:gt-xsd-core","ecosystem":"Maven","purl":"pkg:maven/org.geotools.xsd/gt-xsd-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"28.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/02/GHSA-w3pj-wh35-fq8w/GHSA-w3pj-wh35-fq8w.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}