GeoTools has unauthenticated SQL injection in the jsonArrayContains filter function against PostGIS layers

Summary

An SQL Injection Vulnerability has been found when executing OGC Filters with PostGIS DataStore implementation:

• jsonArrayContains function

Requires PostGIS 12 or greater with a String or JSON field

For PostGIS 12 and greater jsonArrayContains( , , ) function writes into generated SQL without escaping.

Patches

• GeoTools 35.1

• GeoTools 33.5

• GeoTools 34.4

Mitigation

No mitigation is available:

• To limit scope of SQL Injection the PostGIS connection pool should be configured with limited rights.

Impact

This vulnerability can lead to execution of arbitrary SQL expressions in the database.

References

• https://osgeo-org.atlassian.net/browse/GEOT-7958

• https://osgeo-org.atlassian.net/browse/GEOT-7959

• geotools/geotools#5829

• https://osgeo-org.atlassian.net/browse/GEOT-7589

References

• GHSA-mqjf-5f49-2fjh

• geotools/geotools#5829

• geotools/geotools@d821c4d

• https://github.com/geotools/geotools/releases/tag/33.6

• https://github.com/geotools/geotools/releases/tag/34.5

• https://github.com/geotools/geotools/releases/tag/35.1

• https://osgeo-org.atlassian.net/browse/GEOT-7589

• https://osgeo-org.atlassian.net/browse/GEOT-7958

• https://osgeo-org.atlassian.net/browse/GEOT-7959