CVE-2023-25157
Published: 21 February 2023
Summary
CVE-2023-25157 is a critical-severity SQL Injection (CWE-89) vulnerability in Osgeo Geoserver. Its CVSS base score is 9.8 (Critical).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
GeoServer, an open source Java-based server for sharing and editing geospatial data, contains a SQL injection vulnerability tracked as CVE-2023-25157. The flaw resides in the handling of the OGC Filter expression language and Common Query Language (CQL) within the Web Feature Service, Web Map Service, and Web Coverage Service protocols when the PostGIS Datastore is in use, and is classified under CWE-89 with a CVSS 3.1 score of 9.8.
Unauthenticated remote attackers can supply crafted CQL or Filter expressions that target functions such as strEndsWith, strStartsWith, PropertyIsLike, or FeatureId, allowing them to execute arbitrary SQL statements against the underlying database and potentially achieve full compromise of confidentiality, integrity, and availability.
Official advisories recommend upgrading to GeoServer 2.21.4 or 2.22.2. For instances that cannot be updated immediately, administrators can disable the PostGIS Datastore encode functions setting to block misuse of the string functions and enable the preparedStatements setting to mitigate the FeatureId vector. The associated EPSS score has remained at a peak of 0.9406 since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-0652
Vulnerability details
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web…
more
Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.