CISA: Attackers Breach Federal Agency via Critical GeoServer Flaw

CISA disclosed that threat actors breached a large federal civilian executive branch agency last year by exploiting CVE-2024-36401 in the open source GeoServer mapping server, a flaw rated 9.8 on the CVSS scale. According to CISA's advisory, the attackers gained initial access around 11 July 2024, less than two weeks after the vulnerability was disclosed, and then used the same flaw to access a second GeoServer, before moving laterally to two additional servers over a three‑week period.

The agency also noted that the attackers' activities were not detected for three weeks and that the breach involved downloading open source scripts, using living-off-the-land techniques, and dropping Web shells such as China Chopper after pivoting to a Web server and an SQL server. CISA added CVE-2024-36401 to the Known Exploited Vulnerabilities (KEV) catalog on 15 July 2024, and urged immediate remediation within vulnerability management and incident response planning.

The report highlights gaps in patching, incident response testing, and logging, emphasising the need for comprehensive monitoring of KEV vulnerabilities and continuous review of EDR alerts.