Potential GeoServer SQLi Probe for CVE-2023-25157 via OWS CQL_FILTER

title: Potential GeoServer SQLi Probe for CVE-2023-25157 via OWS CQL_FILTER
id: 0fc5e8ac-f96a-42a9-aed6-5540d96c8ad4
status: test
description: This rule flags HTTP GET requests to GeoServer OWS endpoints that include a CQL_FILTER parameter containing patterns consistent with SQL injection probing. It matches URL query components indicative of filter/function usage and common injection payload fragments such as UNION/SELECT/WHERE and SQL function encodings. The detection relies on webserver request telemetry including the full request method and query string to correlate these indicators in a single request.
references:
  - https://github.com/win3zz/CVE-2023-25157
  - https://twitter.com/parzel2/status/1665726454489915395
  - https://github.com/advisories/GHSA-7g5f-wrx8-5ccf
  - https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Exploits/CVE-2023-25157/web_cve_2023_25157_geoserver_sql_injection.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-06-14
tags:
  - attack.initial-access
  - cve.2023-25157
  - detection.emerging-threats
logsource:
  category: webserver
detection:
  selection_url:
    cs-method: GET
    cs-uri-query|contains|all:
      - /geoserver/ows
      - CQL_FILTER=
    cs-uri-query|contains:
      - PropertyIsLike
      - strEndsWith
      - strStartsWith
      - FeatureId
      - jsonArrayContains
      - DWithin
  selection_payload:
    cs-uri-query|contains:
      - +--
      - +AS+
      - +OR+
      - FROM
      - ORDER+BY
      - SELECT
      - sleep%28
      - substring%28
      - UNION
      - WHERE
  condition: all of selection_*
falsepositives:
  - Vulnerability scanners
level: high
license: DRL-1.1
related:
  - id: c0341543-5ed0-4475-aabc-7eea8c52aa66
    type: derived