Classpath resource disclosure in GWC Web Resource API on Windows / Tomcat

The core of this vulnerability lies in the insufficient input validation within GeoServer's GeoWebCache ByteStreamController. An attacker can craft specific requests to bypass these checks and access files within the GeoServer classpath. If GeoServer is deployed on Windows using Apache Tomcat and the data directory is embedded within the geoserver.war file (a common configuration in some environments), the attacker could potentially read sensitive configuration files or even executable code, leading to administrator privileges. This is a significant escalation of privileges, allowing an attacker to control the GeoServer instance and potentially the underlying system. The ability to read arbitrary files also presents a data exfiltration risk, exposing potentially sensitive geospatial data managed by GeoServer.

Organizations deploying GeoServer on Windows with Apache Tomcat, particularly those using embedded data directories, are at the highest risk. Legacy GeoServer installations and environments with limited security monitoring are also vulnerable. Shared hosting environments where GeoServer is deployed alongside other applications should be carefully assessed.

• linux / server:

find /opt/geoserver/ -name '*.class' -exec grep -i 'ByteStreamController' {} + | grep -i 'readfile' 

• java / server: Examine GeoServer logs for unusual file access attempts, especially those targeting classpath resources. Look for patterns indicating attempts to read files outside of expected directories. • generic web: Use curl or wget to probe GeoServer endpoints and observe responses for unexpected file content or error messages related to file access.

1. 2024-07-01Disclosure

   disclosure

1. Reserviert2024-01-29
2. Veröffentlicht2024-07-01
3. Geändert2025-11-04
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-24749 is to upgrade GeoServer to version 2.23.5 or later. If an immediate upgrade is not feasible due to compatibility concerns or testing requirements, consider deploying GeoServer with an external data directory instead of an embedded one, as this significantly reduces the potential for privilege escalation. While a direct WAF rule is unlikely to be effective against this type of bypass, reviewing and hardening input validation routines within custom GeoServer extensions is recommended. Monitor GeoServer logs for unusual file access attempts, particularly those targeting classpath resources.