GeoServer's jsonArrayContains Unauthenticated SQL Injection and RCE Zero-Day
Technical breakdown of the actively exploited jsonArrayContains SQL injection zero-day in GeoServer leading to PostGIS/Oracle database compromise and RCE.
An unauthenticated critical SQL injection vulnerability in GeoServer's jsonArrayContains filter function allows remote threat actors to manipulate underlying spatial databases and execute arbitrary code on geospatial servers.
GHSA-mqjf-5f49-2fjh / GeoServer Zero-Day (CWE-89: SQL Injection)
Severity: Critical (CVSS 9.8)
Status: 🚨 Actively Exploited in the Wild (Mass Scanning Observed)
Affected Systems: GeoServer versions prior to 3.0.1, 2.28.5, and 2.27.6
Fixed In: GeoServer 3.0.1, 2.28.5, 2.27.6
Root-Cause Analysis & Mechanics
The vulnerability resides within GeoServer's handling of the Common Query Language (CQL / ECQL) filter function jsonArrayContains. When processing unauthenticated OGC filter queries (via WFS, WMS, or WPS service endpoints), GeoServer evaluates user-supplied arguments without rigorous parameter sanitization.
When connected to backends such as PostGIS (PostgreSQL 12+) or Oracle spatial databases, an unauthenticated attacker can supply crafted JSON path payloads that escape literal escaping and inject arbitrary SQL clauses. In configurations where the database user possesses elevated privileges or pg_read_file/pg_write_file or COPY FROM PROGRAM permissions, this escalates directly to Remote Code Execution (RCE).
Exploitation & Detection Telemetry
cql_filter, CQL_FILTER, or filter parameters containing jsonArrayContains(.
Look for payload patterns attempting database escape: jsonArrayContains(..., ''');-- or embedded hex-encoded commands.
Audit backend database logs for anomalous multi-statement executions originating from the GeoServer connection pool.
