GeoServer OGC Filter / Property Name XPath Evaluation Remote Code Execution

#!/usr/bin/env bash
# check_cve_2024_36401.sh — Detect CVE-2024-36401 in GeoServer installations
# Usage: ./check_cve_2024_36401.sh <GEOSERVER_HOME>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -euo pipefail

GS_HOME="${1:-/opt/geoserver}"
WEBAPP="$GS_HOME/webapps/geoserver"
RESULT="UNKNOWN"

if [ ! -d "$WEBAPP" ] && [ -d "$GS_HOME/data" ]; then
  # Try common alternative layouts
  for candidate in "$GS_HOME" "$GS_HOME/webapps/geoserver" /var/lib/tomcat*/webapps/geoserver /usr/share/geoserver/webapps/geoserver; do
    [ -d "$candidate/WEB-INF" ] && WEBAPP="$candidate" && break
  done
fi

if [ ! -d "$WEBAPP/WEB-INF" ]; then
  echo "[!] Cannot find GeoServer webapp directory. Tried: $WEBAPP"
  echo "UNKNOWN"
  exit 2
fi

# Extract version from manifest or version file
VERSION=""
if [ -f "$WEBAPP/WEB-INF/classes/GeoServerApplication.properties" ]; then
  VERSION=$(grep -oP 'version=\K[0-9.]+' "$WEBAPP/WEB-INF/classes/GeoServerApplication.properties" 2>/dev/null || true)
fi
if [ -z "$VERSION" ]; then
  VERSION=$(unzip -p "$WEBAPP/WEB-INF/lib/gs-main-"*.jar META-INF/MANIFEST.MF 2>/dev/null | grep -oP 'Implementation-Version: \K[0-9.]+' || true)
fi
if [ -z "$VERSION" ]; then
  VERSION=$(ls "$WEBAPP/WEB-INF/lib/gs-main-"*.jar 2>/dev/null | grep -oP 'gs-main-\K[0-9.]+' || true)
fi

# Check for gt-complex JAR (workaround indicator)
GT_COMPLEX=$(ls "$WEBAPP/WEB-INF/lib/gt-complex-"*.jar 2>/dev/null | head -1 || true)

echo "=== CVE-2024-36401 Check ==="
echo "GeoServer path: $WEBAPP"
echo "Detected version: ${VERSION:-not found}"
echo "gt-complex JAR: ${GT_COMPLEX:-REMOVED (workaround applied)}"
echo ""

if [ -z "$VERSION" ]; then
  echo "[!] Could not determine GeoServer version."
  if [ -z "$GT_COMPLEX" ]; then
    echo "[+] gt-complex JAR has been removed — workaround is in place."
    RESULT="PATCHED"
  else
    RESULT="UNKNOWN"
  fi
else
  # Version comparison
  ver_compare() {
    printf '%s\n' "$1" "$2" | sort -V | head -n1
  }
  MAJOR_MINOR=$(echo "$VERSION" | cut -d. -f1,2)
  case "$MAJOR_MINOR" in
    2.25)
      if [ "$(ver_compare "$VERSION" "2.25.2")" = "$VERSION" ] && [ "$VERSION" != "2.25.2" ]; then
        RESULT="VULNERABLE"
      else
        RESULT="PATCHED"
      fi
      ;;
    2.24)
      if [ "$(ver_compare "$VERSION" "2.24.4")" = "$VERSION" ] && [ "$VERSION" != "2.24.4" ]; then
        RESULT="VULNERABLE"
      else
        RESULT="PATCHED"
      fi
      ;;
    2.23)
      if [ "$(ver_compare "$VERSION" "2.23.6")" = "$VERSION" ] && [ "$VERSION" != "2.23.6" ]; then
        RESULT="VULNERABLE"
      else
        RESULT="PATCHED"
      fi
      ;;
    2.22)
      if [ "$(ver_compare "$VERSION" "2.22.6")" = "$VERSION" ] && [ "$VERSION" != "2.22.6" ]; then
        RESULT="VULNERABLE"
      else
        RESULT="PATCHED"
      fi
      ;;
    *)
      # Versions before 2.22 are all vulnerable
      if [ "$(ver_compare "$VERSION" "2.22.0")" = "$VERSION" ]; then
        RESULT="VULNERABLE"
      else
        # 2.26+ would be patched
        RESULT="PATCHED"
      fi
      ;;
  esac
  # Override if workaround applied
  if [ "$RESULT" = "VULNERABLE" ] && [ -z "$GT_COMPLEX" ]; then
    echo "[*] Vulnerable version detected but gt-complex JAR removed — workaround active."
    RESULT="PATCHED"
  fi
fi

echo ""
echo "$RESULT"
case "$RESULT" in
  VULNERABLE) exit 1 ;;
  PATCHED) exit 0 ;;
  *) exit 2 ;;
esac