Potential GeoServer SQL Injection Exploitation Attempt via OWS CQL_FILTER

title: Potential GeoServer SQL Injection Exploitation Attempt via OWS CQL_FILTER
id: 0fc5e8ac-f96a-42a9-aed6-5540d96c8ad4
status: test
description: This rule flags web requests to the GeoServer OWS endpoint where the query string includes a CQL_FILTER plus common SQLi-related payload patterns. It matters because attackers may use crafted CQL functions and SQL keywords to probe or exploit injection flaws. The detection relies on webserver HTTP request telemetry capturing the URL path and query string, including specific function names and SQL-like fragments.
references:
  - https://github.com/win3zz/CVE-2023-25157
  - https://twitter.com/parzel2/status/1665726454489915395
  - https://github.com/advisories/GHSA-7g5f-wrx8-5ccf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-25157/web_cve_2023_25157_geoserver_sql_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-14
tags:
  - attack.initial-access
  - cve.2023-25157
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_url:
    cs-method: GET
    cs-uri-query|contains|all:
      - /geoserver/ows
      - CQL_FILTER=
    cs-uri-query|contains:
      - PropertyIsLike
      - strEndsWith
      - strStartsWith
      - FeatureId
      - jsonArrayContains
      - DWithin
  selection_payload:
    cs-uri-query|contains:
      - +--
      - +AS+
      - +OR+
      - FROM
      - ORDER+BY
      - SELECT
      - sleep%28
      - substring%28
      - UNION
      - WHERE
  condition: all of selection_*
falsepositives:
  - Vulnerability scanners
level: high
license: DRL-1.1
related:
  - id: c0341543-5ed0-4475-aabc-7eea8c52aa66
    type: derived