| Severity | CRITICAL |
| Threat Category | Vulnerability (SQL Injection, Potential Remote Code Execution) |
| Affected Platforms | GeoServer Application versions < 2.27.6, < 2.28.5, and < 3.0.1. GeoTools Core Library: PostGIS DataStore (org.geotools:gt-jdbc-postgis) versions 35.0, >= 34.0, < 34.5, and >= 33.1, < 33.6. Backend DataStore deployments using PostGIS 12 or greater with a String or JSON field. Oracle JDBC DataStores and other relational backends are also reported as affected in related research. |
| CVE | None yet; tracked as GHSA-mqjf-5f49-2fjh |
| CVSS | 9.8 (Critical) |
1. Overview
BtCIRT is issuing an advisory regarding a critical SQL injection vulnerability in GeoServer, an open-source geospatial data server. The vulnerability which is tracked as ‘GHSA-mqjf-5f49-2fjh’ can allow unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers.
Threat intelligence researchers (such as watchTowr) have reported exploitation attempts within hours of the vulnerability’s disclosure on 12th August, originating from a small pool of IP addresses before patches were published. Unpatched versions of the platform can allow unauthenticated remote code execution (RCE), potentially leading to full server takeover and botnet recruitment if the database runs with administrative privileges.
GeoServer has released patches 3.0.1, 2.28.5, or 2.27.6 to address this issue.
2. Who is Affected
BtCIRT has no confirmed reports of exploitation within Bhutan. The risk is nonetheless assessed as Critical as the vulnerability was a true zero-day disclosed before a patch existed with internet-wide probing reported within hours of disclosure. Any organization running GeoServer to share and process geospatial data with an affected PostGIS or Oracle JDBC DataStore, especially if internet-facing, should treat itself as exposed until patched.
3. How the [Threat/Vulnerability/Attack] Works
This vulnerability can lead to execution of arbitrary SQL expressions in the database.
- Root Cause: The jsonArrayContains(<column>, <pointer>, <value>) filter function in GeoTools/GeoServer fails to escape user-supplied input when constructing backend SQL queries.
- Trigger and exploitation: An unauthenticated attacker can transmit a crafted OGC request (via WFS or WMS) containing a malicious jsonArrayContains filter expression to a GeoServer instance backed by PostGIS (12+) or Oracle JDBC DataStores, resulting in SQL injection.
- Escalation to RCE: If the database connection is configured with administrative privileges (e.g., PostgreSQL superuser or pg_execute_server_program), the injection can be leveraged to execute arbitrary operating system commands (Remote Code Execution) on the database host.
5. Recommendations
For organizations and government offices:
1. Immediate Upgrade: Upgrade GeoServer instances to versions 3.0.1, 2.28.5, or 2.27.6 (released 14 August 2026) immediately. Please note that disabling encode functions or enabling preparedStatements (the mitigation applied for CVE-2023-25158) does not protect against GHSA-mqjf-5f49-2fjh. Upgrading or restricting endpoint access is mandatory.
2. Restrict access: If immediate patching isn’t possible, restrict public access to GeoServer/PostGIS instances and tightly control OGC Filter endpoints.
3. Deploy or update WAF rules: Block against SQL-injection patterns in jsonArrayContains expressions.
4. Database hardening: Apply least privilege to the GeoServer database account (avoid superuser/administrative roles) to limit RCE potential even if injection occurs.
5. Log monitoring: Monitor logs for unusual requests targeting WFS/WMS services containing jsonArrayContains parameters.
6. Reporting
If you suspect your organization, device or account has been affected by this threat, or observe activity matching this pattern, please report it to BtCIRT at cirt@btcirt.bt