Press play to start listening
Attackers are probing internet-facing GeoServer systems for a critical SQL injection vulnerability affecting deployments that use PostGIS 12 or later with a text or JSON field. The flaw can be reached without authentication through exposed mapping interfaces and may allow access to information available to the GeoServer database account.
If PostgreSQL grants the GeoServer database account superuser access or the pg_execute_server_program role, an attacker could execute operating-system commands on the database host. That host may be separate from the server running GeoServer.
Security researcher @q1uf3ng publicly disclosed the flaw as a zero-day on August 12. Security firm Hadrian later published a technical analysis describing a working proof of concept that reached remote code execution under the required PostgreSQL configuration.
How the SQL Injection Works
Hadrian traced the vulnerable code to FilterToSqlHelper.java in the GeoTools PostGIS datastore module, published as org.geotools:gt-jdbc-postgis. GeoServer uses this component to translate filters applied to PostGIS-backed map layers into SQL queries.
The unauthenticated SQL injection affects the jsonArrayContains function when GeoServer processes Open Geospatial Consortium filters against a PostGIS 12 or later datastore containing a text or JSON field. Publicly reachable Web Feature Service (WFS) and Web Map Service (WMS) endpoints can accept attacker-controlled CQL filters, which GeoTools translates into SQL.
The vulnerable function inserts the supplied value into PostgreSQL’s jsonb_path_exists() expression without escaping it. A specially prepared request can therefore alter the resulting database query without requiring a GeoServer account.
WatchTowr told Hackread.com that it recorded hundreds of attempts within hours of disclosure. The requests came from a small number of IP addresses and appeared to be testing systems, not completing the remote code execution chain.
Jake Knott, principal security researcher at watchTowr, told Hackread.com that the current probes were “triggering errors and not proceeding further.” He warned that the bug can lead to remote code execution in certain configurations.
From SQL Injection to Remote Code Execution
Hadrian found that WFS 2.0 places filters inside a count query containing a derived table. That query form blocks the simple stacked-statement method used in its remote code execution chain, although the underlying SQL injection remains present.
WFS 1.0 does not add the same count query, allowing injected input to reach the top level of the SQL statement. An attacker can then add a second PostgreSQL statement and use COPY ... TO PROGRAM to run a command when the database account has the required privileges. Hadrian also found a more complicated route through WMS.
The attack does not require the JDBC setting preferQueryMode=simple. Hadrian reproduced stacked-query execution using the default extended mode. Without elevated PostgreSQL privileges, an attacker could still use error-based or time-based techniques to extract information accessible to the database account.
GeoServer Releases Security Updates
The flaw is tracked as GHSA-mqjf-5f49-2fjh and has a critical CVSS 3.1 score of 9.8. No CVE identifier had been assigned at publication. Maintainers described it as a regression of CVE-2023-25158 affecting jsonArrayContains.
GeoServer released versions 3.0.1, 2.28.5 and 2.27.6 on August 14. The corresponding corrected GeoTools versions are 35.1, 34.5 and 33.6. Hadrian lists GeoServer 2.25.3 and later as affected when the required PostGIS conditions are present, so installations on older unsupported branches should move to a supported fixed release.
The GitHub advisory says no effective mitigation is available. Administrators should install a corrected version immediately. Restricting access to WFS and WMS endpoints can reduce exposure while updates are being applied, but it does not repair the vulnerable code. Organizations should also review PostgreSQL account privileges and inspect logs for suspicious CQL filter requests.
GeoServer has been targeted before. In 2024, attackers exploited CVE-2024-36401 to deploy botnet malware, cryptocurrency miners, and other malicious tools on compromised systems.
