GeoServer & GeoTools SQL Injection (CVE-2023-25157 & CVE-2023-25158) — Vulnerability Lab & PoC Report

Practical environment (Vulnerable Lab) and detailed exploitation analysis report for SQL Injection (Error-based) vulnerability in GeoServer (CVE-2023-25157) and the GeoTools library (CVE-2023-25158).

Detailed Analysis & Exploitation Report

Please see the full analysis document with PoC images illustrating each layer in the official report:

👉 View Detailed Exploitation Report (REPORT.md)

(The report includes: Root cause at the CQL Parser & SQL Translator layer, explanation of the OGC XML Filter format, detailed analysis of 4 attack vectors, payloads, actual SQL queries beneath the Database, and remediation recommendations).

Vulnerability Information (Quick Summary)

Attack Vectors Analyzed

In this lab, 4 actual attack vectors have been verified and analyzed in detail in REPORT.md:

1. Vector 1 (strStartsWith): Exploitation via string prefix check function in CQL_FILTER (HTTP GET).
2. Vector 2 (strEndsWith): Exploitation via string suffix check function in CQL_FILTER (HTTP GET).
3. Vector 3 (PropertyIsLike): Exploitation via the standard OGC XML Filter tag manipulating the escape character (HTTP POST) — Most dangerous vector works on all default configurations.
4. Vector 4 (FeatureId): Exploitation via the String Primary Key filter parameter when preparedStatements = false.

Lab Startup Guide (Docker)

Requirements

• Docker & Docker Compose installed on the system.

1. Start the environment

In the project root directory, open a Terminal and run the command:

docker compose up -d

The system will start 2 containers:

• PostGIS / PostgreSQL database (pre-loaded with the vulhub database containing tables example and example_str).
• GeoServer 2.22.1 (pre-configured with DataStore connection and published target Feature Types).

2. Check status

Check GeoServer logs to ensure the service has started completely:

docker compose logs -f geoserver

When the message CONFIGURATION COMPLETE appears, you can access GeoServer at:

• URL Web UI: http://localhost:8080/geoserver/web/
• Default admin account: admin / geoserver

3. Clean up environment after testing

To stop containers and free resources:

# Tắt lab (giữ lại dữ liệu database)
docker compose down

# Tắt lab và xóa sạch toàn bộ dữ liệu volume
docker compose down -v

Repository Structure

├── REPORT.md               # Báo cáo phân tích kỹ thuật & PoC chi tiết
├── docker-compose.yml      # Cấu hình khởi tạo môi trường lab GeoServer + PostgreSQL
├── init.sql                # Script khởi tạo database và dữ liệu mẫu cho lab
├── startup.sh              # Script cấu hình tự động GeoServer khi khởi chạy container
└── img/                    # Thư mục chứa hình ảnh minh chứng PoC