CVE-2023-25158: GeoTools OGC Filter SQL Injection Vulnerabilities
Summary
CVE-2023-25158: GeoTools OGC Filter SQL Injection Vulnerabilities. Affects org.geotools:gt-jdbc across 5 version ranges.
< 24.7
>= 25.0, < 25.7
>= 26.0, < 26.7
>= 27.0, < 27.4
>= 28.0, < 28.2
Fixed in 5 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
GeoTools is an open-source Java library that provides tools for geospatial data processing. It includes support for OGC Filter expression language parsing, encoding, and execution against various data stores. This vulnerability affects the JDBCDataStore implementations in GeoTools.
Vulnerability Detail
The vulnerability involves SQL injection when executing OGC Filters with JDBCDataStore implementations. Several specific filters and functions are affected, including PropertyIsLike, strEndsWith, strStartsWith, FeatureId, jsonArrayContains, and DWithin. The impact varies depending on the data store used and the specific filter or function. For example, in some cases, an attacker could execute arbitrary SQL queries, potentially leading to unauthorized data access or modification.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 24.724.7 -
>= 25.0, < 25.725.7 -
>= 26.0, < 26.726.7 -
>= 27.0, < 27.427.4 -
>= 28.0, < 28.228.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
A partial mitigation can be achieved by disabling "encode functions" in the PostGIS DataStore or enabling "prepared statements" in any PostGIS database. Here is an example of enabling "prepared statements" in a PostGIS DataStore:
Map<String, Object> params = new HashMap<>();
params.put("dbtype", "postgis");
params.put("host", "localhost");
params.put("port", 5432);
params.put("schema", "public");
params.put("database", "database");
params.put("user", "postgres");
params.put("passwd", "postgres");
params.put("preparedStatements", true ); // mitigation
params.put("encode functions", false ); // mitigation
DataStore dataStore = DataStoreFinder.getDataStore(params);
Conclusion
The GeoTools OGC Filter SQL Injection Vulnerabilities pose a significant security risk, potentially allowing attackers to execute arbitrary SQL queries. It is crucial to update GeoTools to one of the patched versions and apply the recommended fixes. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for org.geotools:gt-jdbc →
FAQ
GeoTools is an open-source Java library for geospatial data processing.
OGC Filter expression language is a standard language for querying geospatial data.
The vulnerability affects GeoTools versions 24.7 to 28.1.
The vulnerability could allow an attacker to execute arbitrary SQL queries, potentially leading to unauthorized data access or modification.
A partial mitigation can be achieved by disabling "encode functions" in the PostGIS DataStore or enabling "prepared statements" in any PostGIS database.
