CISA SAYS HACKERS BREACHED FEDERAL AGENCY USING GEOSERVER EXPLOIT

Summary from the TLDR InfoSec newsletter

Attackers exploited CVE-2024-36401, a critical GeoServer RCE vulnerability, to breach a US federal agency. They maintained access for three weeks before detection. The threat actors deployed China Chopper webshells, moved laterally to web and SQL servers, and used brute force techniques for privilege escalation and credential harvesting. Organizations should prioritize patching critical vulnerabilities in CISA's KEV catalog and ensure continuous EDR monitoring, as over 16,000 GeoServer instances remain exposed online.