DEV Community

Anoymask
Anoymask

Posted on Edited on

GeoServer jsonArrayContains SQL Injection: Hundreds of Attempts Observed, RCE Conditions, and the 2023 CVE Gap

#security #threatintel

1. Basic Information

Update Note (2026-09-02): This issue was officially disclosed as GHSA-mqjf-5f49-2fjh / CVE-2026-76904, confirming a vulnerability in the jsonArrayContains handling for PostGIS 12 and later, where the third argument value is embedded unescaped into JSONPath expressions within generated SQL. The escapeJsonLiteral() method identified in previous reports is part of the fixed code, not a discrepancy with PoC descriptions. The GeoTools official team describes this issue as a regression of CVE-2023-25158. Code history shows that a similar defect was reintroduced in the jsonb_path_exists path added by GEOT-7589 in 2024, and escape handling was added to value in the August 2026 fix. The official scope for 2026 is PostGIS; Oracle, mentioned in the initial SecurityWeek report, is not confirmed as a target for CVE-2026-76904.

Version Note: Some text in the GeoTools advisory mentions fixed versions as 33.5 / 34.4. However, the GitHub Advisory Database metadata, CVE records, and actual releases consistently indicate 33.6 / 34.5 / 35.1, which are used in this report.

PoC Note: The PoCs reviewed during analysis involve time-based SQL injection against PostgreSQL, data extraction, and OS command execution under additional conditions. The PoCs themselves are not attached, reproduced, or linked in this report. The direct impact confirmed by the official advisory is arbitrary SQL expression execution on the database; OS command execution depends on additional conditions such as SQL statement processing, available database functions, and database user privileges.

2. Executive Summary

In the GeoTools jsonArrayContains implementation for PostGIS 12 and later, search values specified in requests are embedded unescaped into JSONPath expressions within SQL queries, allowing unauthenticated attackers to execute arbitrary SQL expressions. Affected and fixed versions have been confirmed under CVE-2026-76904, with fixes released in GeoServer 3.0.1, 2.28.5, and 2.27.6. According to watchTowr observations reported by SecurityWeek, hundreds of attack attempts from a small number of source IP addresses were observed within hours of public disclosure. No subsequent activity was confirmed at the time of publication, and no evidence was provided to confirm that SQL injection succeeded in any individual attempt.

3. Attack Flow

Unauthenticated SQL Injection

  1. An attacker sends a request to an externally reachable GeoServer OGC Filter processing endpoint.
  2. The target layer uses PostGIS 12 or later, and jsonArrayContains on a Text/String or JSON column is evaluated using a vulnerable GeoTools version.
  3. The attacker passes a crafted string to the <value> parameter of jsonArrayContains(<column>, <pointer>, <value>).
  4. The vulnerable implementation embeds <value> without escaping into the SQL query containing the JSONPath expression passed to jsonb_path_exists.
  5. PostGIS evaluates a SQL expression that deviates from the intended search criteria.
  6. The attacker attempts to read information, modify data, or cause a denial of service within the permission scope of the database user used by GeoServer.

Attack Attempts Immediately After Disclosure

  1. Technical details of the vulnerability are disclosed on August 12, 2026.
  2. watchTowr observes hundreds of attack attempts from a small number of source IP addresses within hours of disclosure.
  3. SecurityWeek described the observed activity as scanning requests using error responses and other methods to locate vulnerable systems.
  4. As of the publication of the SecurityWeek article, no subsequent activity had been confirmed, and the article provided no evidence to confirm that SQL injection succeeded in any individual attempt.

Additional Scenarios Indicated by Analyzed PoCs

  1. SQL injection succeeds, allowing the execution of additional SQL expressions within the permissions of the database user.
  2. Response time differences are leveraged to infer database names, tables, columns, and stored data.
  3. In configurations where multiple SQL statements or equivalent database functions can be executed, the scope for additional operations expands.
  4. If the PostgreSQL role holds server-side program execution privileges (e.g., pg_execute_server_program), this can escalate to OS command execution on the database host.
  5. This OS command execution is not an unconditional impact of CVE-2026-76904, but depends on database connection settings, available SQL features, and database user privileges.

4. Attacker Position and Execution Location

  • The attacker sends HTTP requests to externally reachable GeoServer OGC Filter processing endpoints.
  • No authentication or user interaction is required, but the target layer must use a vulnerable PostGIS configuration.
  • SQL injection-generated expressions are evaluated by the PostGIS database connected from GeoServer.
  • The impact scope of the SQL execution is constrained by the privileges of the database user utilized by GeoServer.
  • If conditions are met to escalate to OS command execution, the execution location is not necessarily the GeoServer/JVM host, but the database host if PostgreSQL resides on a separate server.
  • Oracle was a target in the 2023 OGC Filter SQL injection issue, but is not included in the official scope of CVE-2026-76904.

5. Visibility for Users and Administrators

What Users See

  • No user actions such as opening links or executing files are required.
  • If attacks or database service disruptions occur, it may manifest as response delays, errors, or unavailability of map and geospatial services.
  • Regular users cannot fix the vulnerability themselves; updates by administrators are required.

What Administrators See

  • Abnormal OGC Filters containing jsonArrayContains, SQL errors, repeated requests from the same source IP, and response time variations may be visible.
  • If SQL injection succeeds, database audit logs may record expressions, queries, updates, or permission errors unexplained by normal GeoServer operations.
  • If conditional RCE succeeds, monitoring is needed not only for the GeoServer Java process but also for child processes under the PostgreSQL service, file creation, and outbound communication.
  • Arrival of attack requests, evaluation of vulnerable functions, successful SQL injection, impact on database data, OS command execution, and subsequent compromise are assessed as distinct stages.

6. Success and Failure Conditions

Success Conditions

  • Reachability from the attacker to GeoServer OGC Filter processing.
  • Use of GeoTools versions 30.5 up to 33.6 (exclusive), 34.0 up to 34.5 (exclusive), or 35.0.
  • Use of PostGIS 12 or later.
  • Presence of Text/String or JSON columns in the target layer, with jsonArrayContains being evaluated.
  • Crafted value parameters bypass WAF or input restrictions and reach vulnerable SQL generation routines.
  • Data read, modification, or destruction permitted after SQL injection is allowed by the database user privileges of GeoServer.
  • Escalation to OS command execution requires available SQL features or SQL statement execution capabilities, plus high privileges on PostgreSQL allowing server-side program execution.

Failure / Mitigation Conditions

  • Updated to GeoServer 3.0.1, 2.28.5, 2.27.6 or later, or corresponding GeoTools 35.1, 34.5, 33.6 or later.
  • PostGIS version is older than 12, or target layers do not use the affected Text/String/JSON columns and jsonArrayContains.
  • GeoServer access is restricted to trusted networks or VPNs.
  • WAF / API gateway temporarily blocks matching abnormal input.
  • Database least privilege restricts data reading, modification, or server-side program execution after SQL injection.

Vendors do not provide known workarounds to prevent the vulnerability itself. Enabling preparedStatements or disabling function encoding, which were mitigations for the 2023 issues, are not effective against this vulnerability. Therefore, public access restrictions, WAFs, and database least privilege are treated as interim auxiliary measures until patched versions are applied.

7. What Happens Upon Success

  • Execution of unintended SQL expressions on the database.
  • Data reading, modification, or deletion within database user permissions.
  • Inference of database structure or data via time-based SQL injection.
  • Availability degradation of GeoServer or database services due to heavy queries or data modifications.
  • OS command execution on the database host in PostgreSQL configurations meeting additional conditions.
  • Subsequent access if database credentials or connection information are obtained.
  • Observations reported by SecurityWeek are limited to attack attempts and scanning requests. The article provided no evidence that SQL injection succeeded in individual attempts, nor any evidence supporting data exfiltration, RCE, or other subsequent compromises.

8. Observable Logs

Email

  • None related.

Proxy / SWG / DNS

  • Requests containing jsonArrayContains sent to GeoServer OGC Filter processing endpoints.
  • Unnatural quotes, JSONPath, SQL operators, comments, or function calls in query strings or POST bodies.
  • Repeated requests varying only conditions from the same source IP.
  • Response time variations corresponding to time-based scanning requests.
  • WAF / reverse proxy blocks, HTTP 4xx / 5xx, or long response times.

Endpoint / EDR

  • Abnormal termination of GeoServer / JVM processes, increased CPU/memory usage, or unusual temporary files.
  • Unexpected child processes such as shells, interpreters, or utilities under the PostgreSQL service account.
  • Unexpected file creation or modification on the database host.
  • Outbound communication from the database host inexplicable by normal business operations.
  • OS command execution by database service accounts.

Identity / IdP

  • Initial attacks require no authentication, so IdP logs likely contain no corresponding sign-ins.
  • Credential usage by GeoServer administrators or database service accounts should be checked separately as subsequent compromise.
  • Changes to database roles, privileges, or connection users.

SaaS / Cloud

  • Access logs for WAFs, load balancers, and API gateways.
  • GeoServer application logs.
  • Audit logs, query logs, and slow query logs for managed PostgreSQL/PostGIS.
  • History of database role and permission changes.
  • Cloud flow logs, process telemetry for database hosts or containers.

Network

  • GeoServer requests concentrated from a small number of source IP addresses in a short time.
  • Unusually high volume of connections or queries from GeoServer to PostGIS.
  • Outbound connections from the database host to unknown destinations.
  • Subsequent internal scanning, callbacks, or lateral movement traffic.

9. Attack Success Determination

Attack Attempt Observed (Success Unconfirmed)

  • Confirm scanning, reconnaissance, or exploitation requests containing jsonArrayContains.
  • Hundreds of activities reported by SecurityWeek fall into this category and are not treated as evidence of successful compromise.

User Interaction Confirmed

  • No user interaction is required for this issue; this stage is not included in attack success conditions.

Initial Execution Confirmed

  • Confirm via application logs or database logs that crafted requests reached GeoServer and were evaluated as jsonArrayContains on the target layer.
  • HTTP 500 errors or response delays alone do not confirm successful SQL injection.

Malware Execution or Authentication Success Confirmed

  • This issue is unauthenticated, and malware execution is not a mandatory condition for successful SQL injection.
  • When confirming conditional RCE, use unexpected OS processes, files, or outbound connections under the PostgreSQL service as evidence.

Data Exfiltration or Session Compromise Confirmed

  • Confirm unintended table/metadata access, data modifications, or bulk retrievals in database audit logs.
  • Correlate repeated requests corresponding to time-based data inference with database activity.
  • Confirm independent evidence separate from HTTP request arrival, such as external data transmission or retrieval results.

Subsequent Compromise Confirmed

  • Confirm new accounts, privilege changes, persistence mechanisms, web shells, internal scanning, credential access, lateral movement, or data exfiltration.

10. Investigation Playbook

Trigger

  • Abnormal OGC Filters containing jsonArrayContains.
  • Repeated reconnaissance requests targeting GeoServer instances published after August 12, 2026.
  • Sudden spikes in SQL errors or response delays in GeoServer/PostGIS.
  • Unexpected OS processes under the PostgreSQL service.

Initial Verification

  • Determine exact versions of GeoServer, GeoTools, and PostGIS, target layers, column types, and usage of jsonArrayContains.
  • Check update status to GeoServer 3.0.1 / 2.28.5 / 2.27.6 or GeoTools 35.1 / 34.5 / 33.6 or later.
  • Identify internet exposure scope, authentication and network restrictions, presence of WAF, and the timestamp and source of the initial abnormal request.
  • Correlate HTTP requests/responses, GeoServer logs, and database audit/query logs using synchronized timestamps.
  • Do not rely solely on the absence of the 2023 CVE fixes to determine safety; independently verify vulnerable versions for CVE-2026-76904.

Endpoint

  • Preserve process trees, application logs, configurations, temporary directories, and sockets for GeoServer / JVM.
  • If PostgreSQL resides on a separate host, prioritize preserving database process trees, service accounts, file integrity, sockets, and audit logs.
  • Check for shells, interpreters, or utilities spawned under database services and their process lineage.

Authentication & Cloud

  • Verify database credentials, database roles, table privileges, and server-side program execution permissions used by GeoServer.
  • Check managed database audit settings, control plane changes, secret access, and snapshot/export operations.
  • Check for suspicious use of database credentials or GeoServer administrator credentials as subsequent compromise.

Subsequent Operations

  • Abnormal access to database metadata or business data.
  • Callbacks or unknown destination communications from the database host.
  • New users, privilege modifications, scheduled tasks, web shells, service registrations.
  • Internal scanning, credential access, lateral movement, and data exfiltration.

Containment

  • Update to fixed versions. Since GeoServer 2.27.x is EOL, apply 2.27.6 as an emergency mitigation while planning migration to a supported branch.
  • Restrict public exposure of GeoServer to trusted networks or VPNs until updated.
  • Temporarily block abnormal jsonArrayContains inputs using WAFs or API gateways.
  • Apply least privilege to database users, removing unnecessary write, administrative, and server-side program execution privileges.
  • Rotate database credentials if there is evidence of successful SQL injection or credential access.
  • Isolate the database host and consider impact investigation and rebuilding if there is evidence of OS command execution.

Verdict Categories

  • Scanned
  • Exploit Attempted
  • SQL Injection Suspected
  • SQL Injection Confirmed
  • Data Access or Modification Confirmed
  • DB Host RCE Confirmed
  • Follow-on Compromise Confirmed

11. Defense & Detection Ideas

Single Events

  • External requests simultaneously containing jsonArrayContains and unnatural quotes, SQL operators, comments, or JSONPath syntax.
  • SQL syntax errors or permission errors in GeoServer/PostGIS.
  • Unexpected child processes from PostgreSQL services to shells, interpreters, or utilities.
  • Outbound connections from the database host to unknown destinations.

Temporal Correlation

  • Crafted OGC Filter -> GeoServer/DB error or response delay -> Abnormal DB query -> DB data read/modification.
  • Repeated requests with minor condition variations -> Consistent time differences -> DB metadata/data access.
  • Attack request -> Child process under database service -> File creation -> Outbound communication.
  • Concentrated reconnaissance requests from a small number of sources shortly after disclosure -> Subsequent access to the same targets.

Hunting Perspectives

  • Inventory of internet-exposed GeoServer instances.
  • Actual versions of GeoServer, GeoTools, and PostGIS.
  • PostGIS layers with Text/String/JSON columns and usage of jsonArrayContains.
  • Abnormal OGC Filters and HTTP 5xx errors since August 12, 2026.
  • Privileges of database users utilized by GeoServer, especially write, administrative, and server-side program execution rights.
  • New processes, files, and network connections under PostgreSQL services.
  • Metadata lookups, long-running queries, and data modifications on database audit logs unexplained by normal operations.

Log Gaps

  • HTTP query strings and POST bodies.
  • GeoServer OGC Filter and application logs.
  • PostgreSQL / PostGIS audit and query logs.
  • Database host process lineage and file telemetry.
  • Point-in-time database role and privilege states.
  • Outbound communication logs for GeoServer and database hosts.
  • Asset information for GeoServer, GeoTools, PostGIS, and target layers.

Priority Countermeasures

  • Update to GeoServer 3.0.1, 2.28.5, 2.27.6 or later, or GeoTools 35.1, 34.5, 33.6 or later.
  • Restrict external exposure of GeoServer to the bare minimum.
  • Apply least privilege to database users.
  • Use WAFs / API gateways as interim virtual patches until updates are applied.
  • Enable log correlation across GeoServer, database hosts, database audits, EDR, and outbound communications.
  • For branch 2.27.x, migrate to a supported branch even after applying 2.27.6.

12. Facts / Inference / Hypothesis

Facts

  • SecurityWeek reported on August 14, 2026, that watchTowr observed hundreds of attack attempts from a small number of source IP addresses within hours of disclosure.
  • At the time of the SecurityWeek article's publication, observed activity was characterized as scanning requests searching for vulnerable systems, with no subsequent activity confirmed. The article provided no evidence to confirm that SQL injection succeeded in individual attempts.
  • This issue was published as GHSA-mqjf-5f49-2fjh / CVE-2026-76904 with a CVSS v3.1 score of 9.8.
  • Affected GeoTools versions are 30.5 up to 33.6 (exclusive), 34.0 up to 34.5 (exclusive), and 35.0; fixes were released in 33.6, 34.5, and 35.1.
  • The target is PostGIS 12 and later, specifically jsonArrayContains on Text/String or JSON columns.
  • Vulnerable implementations embedded the value of jsonArrayContains unescaped into JSONPath expressions within generated SQL queries.
  • The impact confirmed by the official advisory is arbitrary SQL expression execution on the database.
  • The fix commit applies escapeJsonLiteral() to value.
  • The GeoTools official team describes this issue as a regression of CVE-2023-25158.
  • Separate handling for PostGIS 12+ using jsonb_path_exists was added in GEOT-7589 in 2024, and constructEquality() at that time directly embedded string value into JSONPath expressions.
  • GeoServer 3.0.1 / 2.28.5 / 2.27.6 fixed the issue in combination with GeoTools 35.1 / 34.5 / 33.6, respectively.
  • GeoServer branch 2.27.x is EOL, and 2.27.6 was released as an emergency vulnerability fix.
  • The official scope of CVE-2026-76904 is PostGIS; Oracle is not included.
  • Vendors state there are no known workarounds; enabling preparedStatements or disabling function encoding for the 2023 issue are ineffective against this vulnerability.

Inference

  • The discrepancy between escapeJsonLiteral() observed in current code earlier and PoC descriptions is explained by reviewing post-fix code.
  • Rather than a simple evasion of the code fixed in 2023, this can be understood as a regression where a similar defect was reintroduced in a separate processing path added in 2024 for PostGIS 12+.
  • Oracle, mentioned in the initial SecurityWeek report, may have been conflated with the 2023 issue or initial PoC descriptions and should not be generalized as an affected product of CVE-2026-76904.
  • HTTP request observation alone cannot determine SQL injection or RCE success; correlation of GeoServer logs, database audits, and database host process/network telemetry is necessary.
  • If PoC-style OS command execution succeeds in a separated-host configuration, evidence remains on the database host rather than GeoServer.

Hypothesis

  • Attack attempts observed by watchTowr may include automated scanning or PoC validation based on published technical details, but sources, payloads, and success rates have not been published.
  • While data exfiltration, persistence, or lateral movement could potentially follow successful SQL injection, there is no confirmation that this occurred during the observed activity.

13. MITRE ATT&CK Mapping

  • T1190 Exploit Public-Facing Application — Confidence: High. Exploiting externally reachable GeoServer OGC Filter processing without authentication.
  • T1213 Data from Information Repositories — Confidence: Medium. If database data reading via SQL injection is confirmed.
  • T1059 Command and Scripting Interpreter — Confidence: Medium. Limited to cases where additional conditions are met and OS command execution is confirmed on the database host.

14. Open Questions & Further Research

  • Source IP addresses, full payloads, and target counts observed by watchTowr.
  • Instances of successful SQL injection among attack attempts observed by watchTowr.
  • Confirmed cases of data exfiltration, OS command execution, or subsequent compromise originating from CVE-2026-76904.
  • Threat actors, target industries, regions, and objectives involved in actual attacks.
  • Additional conditions such as target versions, SQL statement processing, and database permissions for individual public PoCs.

15. Impact on SOCs and General Organizations

Organizations utilizing GeoServer must verify actual versions of GeoServer, GeoTools, and PostGIS, usage of PostGIS 12+, Text/String/JSON columns, and jsonArrayContains, rather than simply checking if "the 2023 OGC Filter SQL injection is fixed." Affected environments should be updated to patched versions, combined with reduced public exposure and database least privilege. SOCs must distinguish between reconnaissance requests immediately following disclosure and successful compromises, connecting evidence in the order of HTTP requests -> GeoServer filter evaluation -> database queries/data access -> database host processes/networks. Monitoring Java processes alone may cause conditional RCE on database hosts to be missed.

16. Summary by Role

  • For SOCs: Do not treat jsonArrayContains requests alone as a compromise. Correlate GeoServer logs, database audits/queries, and database host processes/networks to assess scanning requests, SQL injection, data impact, and conditional RCE in stages.
  • For Administrators: Update to GeoServer 3.0.1, 2.28.5, 2.27.6 or later, and apply least privilege to PostGIS connection users. Because branch 2.27.x is EOL, apply 2.27.6 as an emergency fix while planning migration to a supported branch. WAFs and exposure restrictions are auxiliary measures and do not replace updates.
  • For Users: Vulnerabilities can be exploited on the server side without user interaction. This is not something regular users can fix; updates by GeoServer administrators are required.

Top comments (0)