Threat actors began exploiting an unpatched GeoServer zero-day within hours of its public disclosure, attack surface management firm WatchTowr says. The security defect, described as an SQL injection issue that could be exploited to achieve remote code execution (RCE), was disclosed on Wednesday by security researcher q1uf3ng.
GeoServer jsonArrayContains flaw and impact
The flaw affects GeoServer’s jsonArrayContains function, a filter expression used to query JSON array fields to check whether they contain specific values. According to the researcher, the issue can be used with PostGIS and Oracle JDBC data stores.
The SQL injection is likely caused by user-supplied arguments being improperly sanitized before they are encoded into database queries, which, under certain configurations, can lead to RCE.
WatchTowr says it observed exploitation attempts shortly after the disclosure. “Within hours of public disclosure, we began observing exploitation attempts and have since recorded hundreds of attempts originating from a small number of source IP addresses. Yet another example of how quickly attackers move once a vulnerability enters the public domain,” WatchTowr’s Jake Knott said.
So far, threat actors have been targeting the defect to probe for vulnerable systems, but WatchTowr has not observed follow-up activity. “However, this is unlikely to remain the case for long: GeoServer has a track record of being targeted and exploited at scale, with multiple vulnerabilities listed in CISA’s Known Exploited Vulnerabilities catalog,” Knott said.
“With no patch currently available and exploitation already underway, organizations running GeoServer should take this vulnerability seriously and, where possible, identify exposed instances, restrict public access, and monitor for a vendor fix,” he added.
GeoServer is a popular open source platform for sharing and processing geospatial data and is used across government, agriculture, telecoms, transit, and other industries.
