GeoServer jsonArrayContains SQLi Confirmed Regression of CVE-2023-25158
GeoServer's GHSA-mqjf-5f49-2fjh SQL injection is a confirmed regression of CVE-2023-25158, enabling unauthenticated RCE. Patch and mitigation details inside.
An unauthenticated SQL injection in GeoServer/GeoTools' jsonArrayContains function (GHSA-mqjf-5f49-2fjh, CVSS 9.8) has been confirmed as a regression of the 2023 CVE-2023-25158 vulnerability. The flaw stems from user input being passed unescaped via String.format() into a PostgreSQL jsonb_path_exists() expression, reachable pre-auth through public WFS/WMS OGC endpoints via CQL_FILTER.
Researchers found the exploitation path differs by service version: WFS 2.0 wraps the filter in a subquery that blocks stacked-query attacks, while WFS 1.0 injects directly into the top-level WHERE clause, enabling a full RCE chain via COPY ... TO PROGRAM — confirmed in a lab reaching a postgres shell on GeoServer 2.26.1 with PostGIS 15. Even without superuser database privileges, error-based and time-based data extraction remain viable.
Notably, GeoTools' own advisory states that the 2023 mitigations — prepared statements and disabling encode functions — do not protect against this variant. The bug was publicly disclosed before a CVE was assigned, with exploitation probes observed within hours; patches shipped in GeoServer 3.0.1/2.28.5/2.27.6 and GeoTools 35.1/34.5/33.6. Teams running GeoServer with PostGIS should patch immediately and re-evaluate prior mitigation assumptions.