geoserver CVE-2023-25157

White Hat 3rd Cohort [Class 30] Kim Jeong-woo

---

github link - https://github.com/custiya/geoserver-CVE-2023-25157

Vulnerability Summary

• CVE-2023-25157 is an SQLi vulnerability that occurred in GeoServer, an open-source map data service web application.
• Occurs in some versions of GeoServer 2.22.0 and below.
• The CQL_FILTER parameter of WFS (Web Feature Service) requests is vulnerable.
• Anyone can exploit if they can access the API without authentication.

Environment Setup

• Run the test environment with the docker compose up -d command.
• Access the page at http://your-ip:8080/geoserver.
• First, you need to discover an existing workspace containing a PostGIS data store.
• Vulhub's GeoServer instance already has a PostGIS data store.
  • Workspace name: vulhub
  • Data store name: pg
  • Table name: example
  • Attribute used: name

poc.py

• A form of SQLi statement created based on the content described above.