How threat actors breached a U.S. federal civilian agency by exploiting a GeoServer flaw

US CISA revealed that threat actors exploited an unpatched vulnerability in GeoServer to breach a U.S. federal civilian agency’s network, tracked as CVE-2024-36401 (CVSS 9.8), a critical remote code execution issue. The flaw was disclosed on 30 June 2024, and in mid-July 2024 it was added to the Known Exploited Vulnerabilities catalog.

According to CISA, the attackers gained access to the agency’s network on 11 July 2024, then exploited the same vulnerability to access a second GeoServer and moved laterally to two other servers. They deployed web shells such as China Chopper and scripts for persistence, remote access, and privilege escalation, and used living-off-the-land techniques to evade detection.

Government investigators found they scanned the public GeoServer with Burp, used a VPS and public tools to exploit CVE-2024-36401 to achieve RCE on two GeoServers, and attempted privilege escalation with the dirtycow tool while abusing xp_cmdshell, BITS jobs and LOTL techniques to hide activity, according to the advisory published by CISA.