Security researchers have confirmed that attackers are actively exploiting a previously unknown SQL injection vulnerability in GeoServer, an open-source platform widely used for managing and publishing geospatial data across government and enterprise environments.
The flaw, disclosed publicly on August 13 by a bug bounty hunter on X, resides in the _jsonArrayContains function and allows unauthenticated remote users to inject arbitrary SQL commands into the backend database. On installations running Microsoft SQL Server with administrator-level database permissions, the vulnerability escalates to remote code execution, giving attackers full control of the underlying system.
Attackers Already Exploiting the Flaw
According to CSO Online, evidence of active exploitation has been observed in the wild since the vulnerability was publicly detailed. The flaw affects all current versions of GeoServer, and no official patch has been released at the time of reporting.
Researchers noted that the attack requires no authentication whatsoever. A remote attacker simply sends a crafted request targeting the _jsonArrayContains endpoint. The vulnerability bypasses standard input validation, allowing the injected SQL to reach the database engine unmodified.
Geospatial Data at Risk
GeoServer is deployed by organizations ranging from national mapping agencies to utilities and smart-city infrastructure operators. The platform powers Web Feature Service and Web Map Service endpoints that expose geospatial datasets over the internet.
A compromised GeoServer instance could expose sensitive geographic information, infrastructure layouts, and proprietary spatial datasets belonging to governments and enterprises alike.
The GeoServer project has not yet issued an official advisory or patch timeline. Administrators are advised to restrict network access to trusted IPs, deploy web application firewall rules targeting the vulnerable function, and monitor server logs for anomalous SQL activity.
This is not the first time GeoServer has faced critical security issues. The platform was previously targeted through CVE-2024-36401, a remote code execution vulnerability that saw widespread exploitation in 2024. The recurrence of unauthenticated attack surface on a widely-deployed geospatial server raises fresh concerns about the security posture of open-source infrastructure software.
Sources: CSO Online; bug bounty disclosure on X; GeoServer project advisories
discussion