CVE-2023-25157: OSGeo GeoServer SQL Injection Vulnerability

CVE-2023-25157 Overview

CVE-2023-25157 is a critical SQL Injection vulnerability affecting GeoServer, an open source software server written in Java that allows users to share and edit geospatial data. The vulnerability exists in GeoServer's support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages.

Attackers can exploit this flaw by crafting malicious CQL queries that bypass input validation, allowing them to execute arbitrary SQL commands against the underlying PostGIS database. This can lead to unauthorized data access, data manipulation, and potentially full system compromise.

Critical Impact

This SQL injection vulnerability allows unauthenticated remote attackers to execute arbitrary SQL commands against the PostGIS database, potentially leading to complete database compromise, sensitive data exfiltration, and lateral movement within the network.

Affected Products

• OSGeo GeoServer versions prior to 2.21.4
• OSGeo GeoServer versions 2.22.x prior to 2.22.2
• GeoServer deployments using PostGIS Datastore with encode functions enabled

Discovery Timeline

• 2023-02-21 - CVE-2023-25157 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-25157

Vulnerability Analysis

The vulnerability stems from insufficient input sanitization in GeoServer's handling of CQL (Common Query Language) expressions. When processing OGC Filter expressions through WFS, WMS, and WCS protocols, GeoServer fails to properly sanitize user-controlled input before incorporating it into SQL queries executed against PostGIS databases.

Specifically, the vulnerability affects multiple CQL functions and expressions including strEndsWith, strStartsWith, PropertyIsLike, and FeatureId operations. These functions can be manipulated to inject malicious SQL code that escapes the intended query context and executes attacker-controlled database commands.

The attack requires no authentication and can be executed remotely over the network with low complexity. Successful exploitation grants attackers the ability to read, modify, or delete database contents, potentially compromising the confidentiality, integrity, and availability of the entire geospatial data infrastructure.

Root Cause

The root cause is improper input validation (CWE-89: SQL Injection) in the CQL expression parser. The vulnerability specifically manifests in how GeoServer constructs SQL queries from user-supplied OGC Filter expressions without adequate sanitization or parameterization. The code fails to escape special characters in comment patterns and does not properly handle prepared statements for all query types.

As shown in the security patch, the fix introduces pattern matching to escape SQL comment sequences that could be used for injection:

// see https://github.com/hibernate/hibernate-orm/commit/59fede7acaaa1579b561407aefa582311f7ebe78
private static final Pattern ESCAPE_CLOSING_COMMENT_PATTERN = Pattern.compile("\\*/");
private static final Pattern ESCAPE_OPENING_COMMENT_PATTERN = Pattern.compile("/\\*");

private boolean debugMode;

public static Dialect detect(DataSource dataSource, boolean debugMode) {
    Dialect dialect;
    try {
        Connection conn = dataSource.getConnection();

Source: GitHub Commit Update

Attack Vector

The attack is executed remotely over the network through GeoServer's web service interfaces. An attacker can craft malicious HTTP requests containing specially crafted CQL expressions targeting any of the vulnerable functions (strEndsWith, strStartsWith, PropertyIsLike, or FeatureId). These requests are processed by GeoServer's WFS, WMS, or WCS endpoints without proper validation.

The attacker does not require any authentication or special privileges to exploit this vulnerability. By injecting SQL comment sequences and malicious query fragments, the attacker can break out of the intended query context and execute arbitrary SQL statements against the PostGIS backend database.

Detection Methods for CVE-2023-25157

Indicators of Compromise

• Unusual or malformed CQL query parameters in GeoServer access logs containing SQL syntax such as --, /*, */, or UNION SELECT
• Unexpected database errors or query failures logged by the PostGIS backend
• Abnormal network traffic patterns to GeoServer WFS/WMS/WCS endpoints with excessively long or encoded parameters
• Evidence of data exfiltration or unauthorized database queries in PostGIS audit logs

Detection Strategies

• Implement web application firewall (WAF) rules to detect and block SQL injection patterns in requests to GeoServer endpoints
• Monitor GeoServer access logs for requests containing suspicious CQL expressions with strEndsWith, strStartsWith, PropertyIsLike, or FeatureId parameters
• Deploy database activity monitoring on PostGIS backends to detect anomalous query patterns or unauthorized data access
• Use intrusion detection systems (IDS) to identify network traffic containing SQL injection payloads targeting GeoServer services

Monitoring Recommendations

• Enable verbose logging on GeoServer instances to capture full request details including CQL parameters
• Configure alerts for failed authentication attempts and unusual query patterns in database logs
• Implement network traffic analysis to identify potential exploitation attempts against GeoServer endpoints
• Regularly review access logs for patterns consistent with SQL injection reconnaissance or exploitation

How to Mitigate CVE-2023-25157

Immediate Actions Required

• Upgrade GeoServer to version 2.21.4 or version 2.22.2 immediately to resolve this vulnerability
• If immediate upgrade is not possible, disable the PostGIS Datastore encode functions setting to mitigate strEndsWith, strStartsWith, and PropertyIsLike misuse
• Enable the PostGIS DataStore preparedStatements setting to mitigate the FeatureId exploitation vector
• Review GeoServer access logs for evidence of exploitation attempts

Patch Information

The GeoServer project has released security patches in versions 2.21.4 and 2.22.2. The fix implements proper input sanitization by escaping SQL comment patterns and improving the dialect detection mechanism to support debug mode for better security controls.

Users should upgrade to the latest patched version by downloading from the official GeoServer website or updating via their package manager. The specific commit addressing this vulnerability is available at the GitHub Commit Update.

For detailed technical information, refer to the GitHub Security Advisory GHSA-7g5f-wrx8-5ccf.

Workarounds

• Disable the PostGIS Datastore encode functions setting in GeoServer configuration to prevent exploitation via strEndsWith, strStartsWith, and PropertyIsLike functions
• Enable the PostGIS DataStore preparedStatements setting to mitigate FeatureId exploitation
• Restrict network access to GeoServer endpoints using firewall rules to limit exposure to trusted networks only
• Deploy a web application firewall (WAF) in front of GeoServer to filter malicious SQL injection attempts

# Configuration example for GeoServer PostGIS Datastore
# In the GeoServer admin interface or datastore configuration:
# 1. Navigate to Stores > [Your PostGIS Store] > Connection Parameters
# 2. Set the following parameters:

# Disable encode functions to prevent strEndsWith/strStartsWith/PropertyIsLike exploitation
encode functions=false

# Enable prepared statements to prevent FeatureId exploitation
preparedStatements=true