GeoServer SQL Injection Vulnerability Lets Unauthenticated Attackers Execute Remote Code
Brief
A newly disclosed SQL injection vulnerability in GeoServer could allow unauthenticated attackers to access backend PostgreSQL databases and, in high-risk configurations, execute operating-system commands on database hosts.
The issue affects GeoServer deployments using PostGIS-backed layers and originates in GeoTools, the library responsible for converting Common Query Language (CQL) filters into SQL queries.
Research published by Melvin Lammerts after an August 12 disclosure by researcher @q1uf3ng found that the vulnerable jsonArrayContains filter function can place attacker-controlled data directly into a PostgreSQL jsonb_path_exists() expression.
GeoServer SQL Injection Vulnerability
The vulnerable behavior stems from GeoTools’ FilterToSqlHelper.java , where the jsonArrayContains implementation builds SQL using Java string formatting rather than safely parameterizing user input.