search

google / tsunami-security-scanner-plugins

This project aims to provide a central repository for many useful Tsunami Security Scanner plugins.
Apache License 2.0
860 stars 178 forks source link

PRP: Request GeoServer SQL Injection Vulnerabilities (CVE-2023-25157) #437

Closed Firebasky closed 3 months ago

Firebasky commented 3 months ago

Hi there.

I would like to start implementing a plugin to detect GeoServer SQL Injection Vulnerabilities (CVE-2023-25157).

Reference: https://nvd.nist.gov/vuln/detail/CVE-2023-25157 https://github.com/geoserver/geoserver/security/advisories/GHSA-7g5f-wrx8-5ccf

Description: GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. GeoServer includes support for the OGC Filter expression language and the OGC Common Query Language (CQL) as part of the Web Feature Service (WFS) and Web Map Service (WMS) protocols. CQL is also supported through the Web Coverage Service (WCS) protocol for ImageMosaic coverages. Users are advised to upgrade to either version 2.21.4, or version 2.22.2 to resolve this issue. Users unable to upgrade should disable the PostGIS Datastore encode functions setting to mitigate strEndsWith, strStartsWith and PropertyIsLike misuse and enable the PostGIS DataStore preparedStatements setting to mitigate the FeatureId misuse. Versions: org.geoserver.community:gs-jdbcconfig@[2.20.0, 2.20.7) org.geoserver.community:gs-jdbcconfig@[2.21.1, 2.21.4) org.geoserver.community:gs-jdbcconfig@[2.22.0, 2.22.2) org.geoserver.community:gs-jdbcconfig@[2.19.0, 2.19.7) org.geoserver.community:gs-jdbcconfig@[2.18.0, 2.18.7)

tooryx commented 3 months ago

Hi @Firebasky,

Thank you for willing to contribute. For now, we are not interested in this plugin (specifically we have limited interest for that software and we tend to favor remote code execution).

~tooryx