GeoServer, a widely used open-source server for sharing and editing geospatial data, has been found to contain a critical SQL injection vulnerability. This flaw allows unauthenticated attackers to execute arbitrary SQL commands, potentially leading to unauthorized data access or manipulation.
The vulnerability resides in the handling of OGC (Open Geospatial Consortium) filter and function expressions within the GeoTools library, which GeoServer relies upon. Specifically, the issue affects the `PropertyIsLike` filter when applied to string fields in relational database stores, as well as the `strEndsWith` and `strStartsWith` functions when used with PostGIS DataStores that have function encoding enabled. Additionally, the `FeatureId` filter is vulnerable when interacting with database tables that have string primary key columns and when prepared statements are disabled.
To mitigate these risks, the GeoServer team has released patches in versions 2.23.0, 2.22.2, 2.21.4, 2.20.7, 2.19.7, and 2.18.7. Users are strongly advised to upgrade to these versions to secure their installations. In the interim, disabling the PostGIS DataStore’s function encoding and enabling prepared statements can help reduce exposure. However, for the `PropertyIsLike` filter vulnerability, no immediate mitigation is available, and users may need to disable database DataStores until they can upgrade.
This incident underscores the importance of regular software updates and vigilant security practices, especially for systems handling sensitive geospatial data. Organizations should review their GeoServer configurations and apply the necessary patches promptly to prevent potential exploitation.
