GHSA-mqjf-5f49-2fjh: SQL Injection
Summary
An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:
jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field
For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.
Patches
GeoTools 35.1 GeoTools 33.5 GeoTools 34.4
Mitigation
No mitigation is available:
To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.
Impact
This vulnerability can lead to execution of arbitrary SQL expressions in the database.
References
https://osgeo-org.atlassian.net/browse/GEOT-7958 https://osgeo-org.atlassian.net/browse/GEOT-7959 https://github.com/geotools/geotools/pull/5829 https://osgeo-org.atlassian.net/browse/GEOT-7589
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.geotools.jdbc:gt-jdbc-postgisto a version that resolves this vulnerability.Fixed in 33.6 - Upgrade
Upgrade
maven/org.geotools.jdbc:gt-jdbc-postgisto a version that resolves this vulnerability.Fixed in 34.5 - Upgrade
Upgrade
maven/org.geotools.jdbc:gt-jdbc-postgisto a version that resolves this vulnerability.Fixed in 35.1 - Compensating control
To limit scope of SQL Injection, configure the PostGIS connection pool with limited rights (least-privilege) when using GeoTools with the PostGIS DataStore implementation for OGC Filters.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using the GeoTools PostGIS DataStore are affected when they execute OGC Filters using jsonArrayContains against PostGIS 12 or later. The affected function requires a String or JSON field.
What does an attacker need to exploit it?
The vulnerable path is reached through an OGC Filter using jsonArrayContains. In affected PostGIS versions, the function writes the supplied value into generated SQL without escaping.
Which GeoTools releases contain patches?
Patches are available in GeoTools 35.1, 34.4, and 33.5.
What can be done if patching cannot happen immediately?
No complete mitigation is available. Configure the PostGIS connection pool to use database credentials with limited rights to reduce the scope of potential SQL injection.
What is the potential impact of successful exploitation?
Successful exploitation can allow execution of arbitrary SQL expressions in the database.