The observed threat is an exploitation attempt targeting Geoserver through CVE-2024-36401, an XPath expression evaluation vulnerability. Attackers send specially crafted WFS GetPropertyValue requests with a valueReference parameter that includes an exec() call to run shell commands. These commands download and execute a script from an external IP address linked to the Rondo botnet. The attack leverages the ability to inject and execute arbitrary code on vulnerable Geoserver instances. The Rondo botnet is known for such attacks and has targeted Geoserver before. The source data does not specify affected versions or patch availability.

Successful exploitation allows remote attackers to execute arbitrary shell commands on the Geoserver host, potentially leading to full system compromise. This can enable attackers to deploy malware such as the Rondo botnet payload, resulting in unauthorized control of the affected system. The impact is significant for affected Geoserver deployments that have not applied mitigations or patches for CVE-2024-36401.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since this is a known vulnerability (CVE-2024-36401), users should consult the official Geoserver security advisories for patches or updates. Until a patch is applied, restricting access to the Geoserver WFS service and monitoring for suspicious requests similar to the described exploit pattern is recommended. No vendor advisory content is provided to indicate that no action is required or that the issue is already mitigated.