Potential GeoServer SQLi Probe for CVE-2023-25157 via OWS CQL_FILTER
Alerts on GET requests to GeoServer OWS with CQL_FILTER containing SQLi-style payload markers and functions.
FreeReviewedSigma · High · v5
- Category
- webserver
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-06-14
- Updated
- 2026-07-31
What it detects
This rule flags HTTP GET requests to GeoServer OWS endpoints that include a CQL_FILTER parameter containing patterns consistent with SQL injection probing. It matches URL query components indicative of filter/function usage and common injection payload fragments such as UNION/SELECT/WHERE and SQL function encodings. The detection relies on webserver request telemetry including the full request method and query string to correlate these indicators in a single request.
Reporting behind it
- github.comhttps://github.com/win3zz/CVE-2023-25157
- twitter.comhttps://twitter.com/parzel2/status/1665726454489915395
- github.comhttps://github.com/advisories/GHSA-7g5f-wrx8-5ccf
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-25157/web_cve_2023_25157_geoserver_sql_injection.yml
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
potential-geoserver-sql-injection-exploitation-attempt-via-ows-cql-filter-c0341543
title: Potential GeoServer SQLi Probe for CVE-2023-25157 via OWS CQL_FILTER
id: 0fc5e8ac-f96a-42a9-aed6-5540d96c8ad4
status: test
description: This rule flags HTTP GET requests to GeoServer OWS endpoints that include a CQL_FILTER parameter containing patterns consistent with SQL injection probing. It matches URL query components indicative of filter/function usage and common injection payload fragments such as UNION/SELECT/WHERE and SQL function encodings. The detection relies on webserver request telemetry including the full request method and query string to correlate these indicators in a single request.
references:
- https://github.com/win3zz/CVE-2023-25157
- https://twitter.com/parzel2/status/1665726454489915395
- https://github.com/advisories/GHSA-7g5f-wrx8-5ccf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-25157/web_cve_2023_25157_geoserver_sql_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-14
tags:
- attack.initial-access
- cve.2023-25157
- detection.emerging-threats
logsource:
category: webserver
detection:
selection_url:
cs-method: GET
cs-uri-query|contains|all:
- /geoserver/ows
- CQL_FILTER=
cs-uri-query|contains:
- PropertyIsLike
- strEndsWith
- strStartsWith
- FeatureId
- jsonArrayContains
- DWithin
selection_payload:
cs-uri-query|contains:
- +--
- +AS+
- +OR+
- FROM
- ORDER+BY
- SELECT
- sleep%28
- substring%28
- UNION
- WHERE
condition: all of selection_*
falsepositives:
- Vulnerability scanners
level: high
license: DRL-1.1
related:
- id: c0341543-5ed0-4475-aabc-7eea8c52aa66
type: derived