CVE-2023-25158
published 2023-02-21CVE-2023-25158: GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding…
PriorityP180critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
1.07%
60.7th percentile
GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| geotools | geotools | < 27.4 | 27.4 |
| geotools | geotools | < 24.7 | 24.7 |
| geotools | geotools | — | — |
| geotools | geotools | >= 25.0 < 25.7 | 25.7 |
| geotools | geotools | >= 26.0 < 26.7 | 26.7 |
| geotools | geotools | >= 27.0 < 27.4 | 27.4 |
| geotools | geotools | >= 28.0 < 28.2 | 28.2 |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vulncheck9.8CRITICAL
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
GeoTools OGC Filter SQL Injection Vulnerabilities
osv·2023-02-22
CVE-2023-25158 [CRITICAL] GeoTools OGC Filter SQL Injection Vulnerabilities
GeoTools OGC Filter SQL Injection Vulnerabilities
### Impact
GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore.
SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations:
1. ``PropertyIsLike`` filter
* Requires PostGIS DataStore with "encode functions" enabled
* Or any JDBCDataStore (all relational databases) with String field (no mitigation)
3. ``strEndsWith`` function
* Requires PostGIS DataStore with "encode functions" enabled
5. ``strStartsWith`` function
* Requires PostGIS DataStore with "encode functions" enabled
6. ``FeatureId`` filter
* Requires JDBCDataStore (all relational databases) with prepared statements disabled and table with String primary key (Orac
GHSA
GeoTools OGC Filter SQL Injection Vulnerabilities
ghsa·2023-02-22
CVE-2023-25158 [CRITICAL] CWE-89 GeoTools OGC Filter SQL Injection Vulnerabilities
GeoTools OGC Filter SQL Injection Vulnerabilities
### Impact
GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore.
SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations:
1. ``PropertyIsLike`` filter
* Requires PostGIS DataStore with "encode functions" enabled
* Or any JDBCDataStore (all relational databases) with String field (no mitigation)
3. ``strEndsWith`` function
* Requires PostGIS DataStore with "encode functions" enabled
5. ``strStartsWith`` function
* Requires PostGIS DataStore with "encode functions" enabled
6. ``FeatureId`` filter
* Requires JDBCDataStore (all relational databases) with prepared statements disabled and table with String primary key (Orac
VulnCheck
geotools geotools Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
vulncheck·2023·CVSS 9.8
CVE-2023-25158 [CRITICAL] geotools geotools Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
geotools geotools Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable `encode functions` for PostGIS DataStores or enable `prepared statements` for JDBCDataStores as a partial mitigation.
Affected: geotools geotools
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if r
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/geotools/geotools/commit/64fb4c47f43ca818c2fe96a94651bff1b3b3ed2bhttps://github.com/geotools/geotools/security/advisories/GHSA-99c3-qc2q-p94mhttps://github.com/geotools/geotools/commit/64fb4c47f43ca818c2fe96a94651bff1b3b3ed2bhttps://github.com/geotools/geotools/security/advisories/GHSA-99c3-qc2q-p94m
2023-02-21
Published
Exploited in the wild