CVE-2023-25158 Unfiltered SQL Injection in Geotools
Attackers can execute arbitrary SQL commands via OGC Filters in GeoTools JDBCDataStore implementations, potentially reading or modifying database contents.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-25158?
CVE-2023-25158 is a critical SQL injection vulnerability in geotools, published on 21 Feb 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation.
Weakness: CWE-89
Which versions are affected by CVE-2023-25158?
10 open source packages ship an affected version, including org.geotools:gt-jdbc. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.geotools:gt-jdbc Maven | All versions | 24.7 |
org.geotools:gt-jdbc Maven | All versions | 24.7 |
org.geotools:gt-jdbc Maven | From 25.0 | 25.7 |
org.geotools:gt-jdbc Maven | From 25.0 | 25.7 |
org.geotools:gt-jdbc Maven | From 26.0 | 26.7 |
org.geotools:gt-jdbc Maven | From 26.0 | 26.7 |
4 more packages
org.geotools:gt-jdbc Maven | From 27.0 | 27.4 |
org.geotools:gt-jdbc Maven | From 27.0 | 27.4 |
org.geotools:gt-jdbc Maven | From 28.0 | 28.2 |
org.geotools:gt-jdbc Maven | From 28.0 | 28.2 |
Products include Geotools Geotools.
How do I fix CVE-2023-25158?
Upgrade org.geotools:gt-jdbc to a fixed version for your release line: 24.7, 25.7, 26.7 or 27.4.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-25158 being exploited?
There is no known exploitation of CVE-2023-25158 in the wild and no public exploit code.
Other vulnerabilities in geotools
Sources
Also known as GHSA-99c3-qc2q-p94m.