Rondo Botnet Exploits GeoServer Vulnerability for Command Execution
The Rondo botnet is actively exploiting a critical vulnerability in GeoServer (CVE-2024-36401) to execute arbitrary commands and deploy malware.
The Rondo botnet has resurfaced, targeting instances of GeoServer, a popular open-source server for sharing geospatial data. Security researchers at the SANS Internet Storm Center observed recent activity where attackers are leveraging CVE-2024-36401, a vulnerability related to XPath expression evaluation within GeoServer. This flaw allows remote attackers to execute arbitrary commands on the affected server.
The exploit involves a crafted HTTP GET request to the GeoServer Web Feature Service (WFS) endpoint. The valueReference parameter is manipulated to include a command that, after URL and Base64 decoding, reveals the malicious payload. The decoded command attempts to download and execute a script named rondo.zyt.sh from a remote IP address (45.153.34.153) using common download utilities like wget or curl.
This specific attack vector is not entirely new; the Rondo botnet has previously been documented targeting GeoServer instances with similar methods. The Rondo botnet is known for its varied and sometimes playful naming conventions, occasionally referencing rap artists in its code or communications. The SANS report notes that the botnet's presence might be transient, with some indicators suggesting it could be removed from compromised hosts, only to reappear or be re-deployed.
GeoServer is widely used by government agencies, research institutions, and private companies for managing and serving geographic information system (GIS) data. Its widespread adoption makes it an attractive target for threat actors seeking to compromise systems that often handle sensitive location-based data or serve as critical infrastructure for mapping and analysis services.
The vulnerability, CVE-2024-36401, stems from improper handling of XPath expressions, allowing for the injection of executable code. This type of vulnerability is particularly dangerous as it bypasses typical input validation mechanisms by exploiting the server's own query processing capabilities.
While the SANS report indicates that the Rondo botnet might be intermittently present on compromised systems, the underlying vulnerability remains a significant risk for any organization running an unpatched GeoServer instance. The ease with which the exploit can be deployed, combined with the botnet's known capabilities, underscores the need for prompt patching and security monitoring.
Organizations using GeoServer are strongly advised to review their configurations and ensure they have applied the latest security patches to mitigate the risk of exploitation. Monitoring network traffic for suspicious requests to GeoServer endpoints, particularly those involving unusual WFS parameters or attempts at command execution, is also a crucial defensive measure.