CISA Reveals Hackers Breached U.S. Federal Agency via GeoServer RCE Flaw

CISA has disclosed that attackers exploited a remote code execution vulnerability in GeoServer to breach a U.S. federal civilian executive branch agency. On 11 July 2024, they used CVE-2024-36401, an “eval injection” weakness, to execute commands on a public-facing server, and the patch had been disclosed 11 days earlier but was not applied.

Eleven days later, the same flaw was exploited against a second GeoServer instance, expanding the breach, after which the intruders moved to a web server and then to an internal SQL server, where xp_cmdshell was used to gain remote code execution. Over the three-week window, some public-facing systems lacked endpoint protection and EDR alerts were not continuously reviewed, and the breach was only detected when an EDR alert flagged a suspicious file transfer on 31 July.

CISA identified three key shortcomings that allowed the breach to persist: untimely patching, unpractised response plans, and incomplete alert monitoring, and recommended rapid patching, exercising incident response plans, and centralising logs to support threat hunting. according to CISA, the advisory provides detailed TTPs and downloadable indicators of compromise in both STIX and JSON formats.