ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2023-25157

—1
CVSS 3.1
9.8 critical
EPSS
85%p100
Published
()
Modified
Description

GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore *encode functions* setting to mitigate ``strEndsWith``, ``strStartsWith`` and ``PropertyIsLike `` misuse and enable the PostGIS DataStore *preparedStatements* setting to mitigate the ``FeatureId`` misuse.

Vendors
osgeo
Products
geoserver
Weakness
CWE-89
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD CVE.org GitHub PoCs EPSS (85.2%)

In the news

GeoServer Zero-Day Targeted in Active Exploitation Attempts, Can Lead to RCE

A CVSS 9.8 SQL injection zero-day in GeoServer's PostGIS datastore enables RCE and drew active exploitation; fixes shipped in versions 3.0.1, 2.28.5, 2.27.6.

A SQL injection flaw in GeoServer's jsonArrayContains function within the GeoTools PostGIS datastore (GHSA-mqjf-5f49-2fjh, CVSS 9.8) was disclosed August 12, 2026, and saw hundreds of exploitation attempts within hours per watchTowr. An attacker-controlled value is interpolated into a PostgreSQL jsonb_path_exists() expression without escaping; with superuser or pg_execute_server_program privileges it escalates to OS command execution via WFS 1.0. GeoServer released versions 3.0.1, 2.28.5, and 2.27.6, and the flaw is a regression of CVE-2023-25158. GeoServer has a history of mass exploitation, including CVE-2024-36401 used for botnets and proxies.

The Hacker News · 29d agoExploit / PoC in the wildCVE-2024-36401CVE-2023-25158CVE-2023-251571

Fake CVE-2023

A fake PoC for WinRAR RCE CVE-2023-40477 posted on GitHub actually deploys VenomRAT through a multi-step infection chain targeting researchers.

Four days after Zero Day Initiative publicly disclosed the WinRAR RCE vulnerability CVE-2023-40477 on August 17, 2023, an actor using the alias whalersplonk published a fake proof-of-concept on GitHub. The Python script actually repurposed public PoC code for GeoServer SQL injection CVE-2023-25157 and triggered an infection chain ending in VenomRAT. The README and an accompanying video lured users into running the script; the video drew over 100 plays. Unit 42 assesses the actor was opportunistic, targeting other miscreants adopting new vulnerabilities rather than researchers specifically.

Palo Alto Unit 42 · 29d agoMalwareCVE-2023-40477CVE-2023-25157