Summary

An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:

jsonArrayContains function Requires PostGIS 12 or greater with a String or JSON field

For PostGIS 12 and greater jsonArrayContains(<column>, <pointer>, <value>) function writes <value> into generated SQL without escaping.

Patches

GeoTools 35.1 GeoTools 33.5 GeoTools 34.4

Mitigation

No mitigation is available:

To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Impact

This vulnerability can lead to execution of arbitrary SQL expressions in the database.

References

https://osgeo-org.atlassian.net/browse/GEOT-7958 https://osgeo-org.atlassian.net/browse/GEOT-7959 https://github.com/geotools/geotools/pull/5829 https://osgeo-org.atlassian.net/browse/GEOT-7589

Summary

GeoServer Web Feature Service (WFS) web service was found to be vulnerable to GeoTools CVE-2025-30220 XML External Entity (XXE) processing attack.

It is possible to trigger the parsing of external DTDs and entities, bypassing standard entity resolvers. This allows for Out-of-Band (OOB) data exfiltration of local files accessible by the GeoServer process, and Service Side Request Forgery (SSRF).

Details

While direct entity resolution is managed by application property ENTITYRESOLUTIONALLOWLIST for XML Parsing, this restriction was not being used by the GeoTools library when building an in-memory XSD Library Schema representation.

This bypasses GeoServer's AllowListEntityResolver enabling XXE attacks.

PoC

No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS service.

Impact

Information Disclosure:

This vulnerability allows unauthenticated attackers to read arbitrary files from the server's filesystem that are accessible to the GeoServer process. This can lead to exposure of sensitive information including configuration files, credentials, and system files. The attack can be performed remotely without authentication, making it particularly severe.

Server-Side Request Forgery (SSRF) The mechanism inherently allows forcing GeoServer to make HTTP requests to arbitrary URLs, enabling SSRF attacks against internal network resources

References

CVE-2025-30220 XML External Entity (XXE) Processing Vulnerability in XSD schema handling External Entities Resolution (GeoServer User Manual)

Acknowledgements

This vulnerability was initially reported via an automated tool described below. Subsequently a duplicate report via @YacineF, and their patience working with the GeoServer project, was instrumental finding in escalating this issue and determining a resolution.

XBOW-025-068 Disclaimer

This vulnerability was detected using XBOW, a system that autonomously finds and exploits potential security vulnerabilities. The finding has been thoroughly reviewed and validated by a security researcher before submission. While XBOW is intended to work autonomously, during its development human experts ensure the accuracy and relevance of its reports.

Summary Remote Code Execution (RCE) is possible if an application uses certain GeoTools functionality to evaluate XPath expressions supplied by user input.

Details The following methods pass XPath expressions to the commons-jxpath library which can execute arbitrary code and would be a security issue if the XPath expressions are provided by user input.

org.geotools.appschema.util.XmlXpathUtilites.getXPathValues(NamespaceSupport, String, Document) org.geotools.appschema.util.XmlXpathUtilites.countXPathNodes(NamespaceSupport, String, Document) org.geotools.appschema.util.XmlXpathUtilites.getSingleXPathValue(NamespaceSupport, String, Document) org.geotools.data.complex.expression.FeaturePropertyAccessorFactory.FeaturePropertyAccessor.get(Object, String, Class<T>) org.geotools.data.complex.expression.FeaturePropertyAccessorFactory.FeaturePropertyAccessor.set(Object, String, Object, Class) org.geotools.data.complex.expression.MapPropertyAccessorFactory.new PropertyAccessor() {...}.get(Object, String, Class<T>) org.geotools.xsd.StreamingParser.StreamingParser(Configuration, InputStream, String)

PoC The following inputs to StreamingParser will delay the response by five seconds: new org.geotools.xsd.StreamingParser( new org.geotools.filter.v10.OGCConfiguration(), new java.io.ByteArrayInputStream("<Filter></Filter>".getBytes()), "java.lang.Thread.sleep(5000)") .parse();

Impact

This vulnerability can lead to executing arbitrary code.

Mitigation

GeoTools can operate with reduced functionality by removing the gt-complex jar from your application. As an example of the impact application schema datastore would not function without the ability to use XPath expressions to query complex content.

The SourceForge download page lists drop-in-replacement jars for GeoTools: 31.1, 30.3, 30.2, 29.2, 28.2, 27.5, 27.4, 26.7, 26.4, 25.2, 24.0. These jars are for download only and are not available from maven central, intended to quickly provide a fix to affected applications.

References https://github.com/geoserver/geoserver/security/advisories/GHSA-6jj6-gm7p-fcvv https://osgeo-org.atlassian.net/browse/GEOT-7587 https://github.com/geotools/geotools/pull/4797 https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852

Summary Multiple OGC request parameters allow Remote Code Execution (RCE) by unauthenticated users through specially crafted input against a default GeoServer installation due to unsafely evaluating property names as XPath expressions.

Details The GeoTools library API that GeoServer calls evaluates property/attribute names for feature types in a way that unsafely passes them to the commons-jxpath library which can execute arbitrary code when evaluating XPath expressions. This XPath evaluation is intended to be used only by complex feature types (i.e., Application Schema data stores) but is incorrectly being applied to simple feature types as well which makes this vulnerability apply to ALL GeoServer instances.

PoC No public PoC is provided but this vulnerability has been confirmed to be exploitable through WFS GetFeature, WFS GetPropertyValue, WMS GetMap, WMS GetFeatureInfo, WMS GetLegendGraphic and WPS Execute requests.

Impact This vulnerability can lead to executing arbitrary code.

Workaround

A workaround exists by removing the gt-complex-x.y.jar file from the GeoServer where x.y is the GeoTools version (e.g., gt-complex-31.1.jar if running GeoServer 2.25.1). This will remove the vulnerable code from GeoServer but may break some GeoServer functionality or prevent GeoServer from deploying if the gt-complex module is needed by an extension you are using:

Mitigation for geoserver.war deploy:

1. Stop the application server 2. Unzip geoserver.war into a directory 3. Locate the file WEB-INF/lib/gt-complex-x.y.jar and remove 4. Zip the directory into a new geoserver.war 5. Restart the application server

Mitigation for GeoServer binary:

1. Stop Jetty 2. Locate the file webapps/geoserver/WEB-INF/lib/gt-complex-x.y.jar and remove 3. Restart Jetty

The following extensions and community modules are known to have a direct dependency on gt-complex jar and are not expected function properly without it. This is not comprehensive list and additional GeoServer functionality may be dependent on the availability of gt-complex jar: Extensions: Application Schema, Catalog Services for the Web, MongoDB Data Store Community Modules: Features-Templating, OGC API Modules, Smart Data Loader, SOLR Data Store

Mitigation available for prior releases patching three jars in your existing install:

1. Patched gt-app-schema, gt-complex and gt-xsd-core jars may be downloaded for GeoServer: 2.25.1, 2.24.3, 2.24.2, 2.23.2, 2.22.2, 2.21.5, 2.21.4,2.20.7, 2.20.4, 2.19.2, 2.18.0. As example the 2.25.1 page links to geoserver-2.25.1-patches.zip download on source forge.

2. Unzip the geoserver-x.y.z-patches.zip which contains three jars that have been patched to configure commons-jxpath with an empty function list prior to use. These files are drop-in replacements with identical file names to those they are replacing.

3. Follow the instructions above to locate WEB-INF/lib folder and replace the existing gt-app-schema, gt-complex and gt-xsd-core jars with those supplied by the patch.

References https://github.com/geotools/geotools/security/advisories/GHSA-w3pj-wh35-fq8w https://osgeo-org.atlassian.net/browse/GEOT-7587 https://github.com/geotools/geotools/pull/4797 https://github.com/Warxim/CVE-2022-41852?tab=readme-ov-file#workaround-for-cve-2022-41852

GeoTools is an open source Java library that provides tools for geospatial data. GeoTools includes support for OGC Filter expression language parsing, encoding and execution against a range of datastore. SQL Injection Vulnerabilities have been found when executing OGC Filters with JDBCDataStore implementations. Users are advised to upgrade to either version 27.4 or to 28.2 to resolve this issue. Users unable to upgrade may disable encode functions for PostGIS DataStores or enable prepared statements for JDBCDataStores as a partial mitigation.

GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code execution. Similar to the Log4J case, the vulnerability can be triggered if the JNDI names are user-provided, but requires admin-level login to be triggered. The lookups are now restricted in GeoTools 26.4, GeoTools 25.6, and GeoTools 24.6. Users unable to upgrade should ensure that any downstream application should not allow usage of remotely provided JNDI strings.