GeoServer jsonArrayContains CQL Filter - SQL Injection
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoTools FilterToSqlHelper.constructEquality writes the expected argument of the jsonArrayContains CQL function RAW into the SQL string while only escaping the JSON pointer. A single quote in the value parameter breaks out of the PostgreSQL jsonb_path_exists string literal, enabling unauthenticated SQL injection. When the PostGIS backend runs with superuser privileges, the injection escalates to operating system command execution through PostgreSQL COPY TO PROGRAM. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should enable the PostGIS DataStore preparedStatements setting and disable encode functions as a workaround. References: https://gist.github.com/portbuster1337/70d75ec246b85e3199037ce212ff1a06 https://github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccf https://nvd.nist.gov/vuln/detail/CVE-2023-25157 https://github.com/geoserver/geoserver/commit/145a8af798590288d270b240235e89c8f0b62e1d Remediation: Upgrade GeoServer to version 2.21.4 or 2.22.2 or later. As an interim workaround, enable the PostGIS DataStore preparedStatements setting to prevent stacked-query abuse and disable encode functions to limit CQL filter function misuse.
Used 18 times · 9 assets checked · domain, subdomain, ipv4