GeoServer Zero-Day SQL Injection Lets Unauthenticated Attackers Target Servers for RCE
Brief
A newly disclosed zero-day vulnerability in GeoServer is drawing urgent attention after security researchers reported that an unauthenticated SQL injection could allow attackers to target exposed geospatial servers and, under specific conditions, achieve remote code execution.
The vulnerability reportedly affects GeoServer’s handling of the jsonArrayContains function within OGC filter processing. GeoServer is widely used to publish geospatial data through standards-based services, including Web Map Service, Web Feature Service, and Web Coverage Service.
These services can accept Common Query Language and filter expressions that are ultimately translated into database queries. If attacker-controlled input is incorporated into that query construction without adequate parameterization, an attacker may be able to alter the underlying SQL command.