GeoServer Flaw Exploited in US Federal Agency Hack

The SecurityWeek report details a year-old GeoServer flaw, CVE-2024-36401 (CVSS 9.8), that was exploited to compromise a US federal civilian executive branch agency, with exploitation disclosed by CISA on 30 June 2024 and added to the KEV catalog shortly after. According to CISA, a threat actor gained access to a GeoServer instance on 11 July 2024, moved laterally to a web server and an SQL server, and uploaded web shells such as China Chopper along with remote-access and persistence scripts.

The attackers used living-off-the-land techniques, brute-forcing credentials, and deployed the Stowaway multi-level proxy tool for C&C, remaining undetected for three weeks before the SOC flagged the breach. The incident was followed by a second exploit on 24 July 2024 in another GeoServer instance belonging to the same agency, with persistence maintained via cron jobs and new user accounts and privilege escalation attempts including Dirty COW.

The article notes that while CISA has not attributed the attack to a specific threat actor, China Chopper is commonly associated with China-linked groups such as APT41, Gallium, and Hafnium; the piece also quotes Tuskira’s Piyush Sharma on the broader risk of unpatched gaps and undetected activity.