GeoServer CVE-2024-36401 response: what the attack chain teaches defenders

How does a public GeoServer bug turn into full intrusion? CISA says CVE-2024-36401 was exploited on public-facing GeoServer systems, then the campaign moved through web shells, cron jobs, valid accounts, brute force, PowerShell, BITS jobs, and Stowaway.^[1]

The sequence mattered: attackers used Burp Scanner to find the flaw, exploited GeoServer 1 and GeoServer 2, then kept persistence with web shells, cron jobs, and valid accounts, including some accounts later deleted.^[2][3][4]

CISA also says they used brute force to get passwords for lateral movement and privilege escalation, abused service accounts, and ran PowerShell plus bitsadmin getfile to pull payloads before BITS jobs and web shell execution helped hide activity.^[5][6][7]

For command and control, the actors used Stowaway through the web server, then a second outbound connection that likely acted as a backup channel. That is why CISA pushes prompt patching, centralized out-of-band logging, incident response practice, and validation of ATT&CK controls.^{[8][9][10][11]}