SecurityWeek has reported that threat actors are actively exploiting an unpatched vulnerability in GeoServer, the widely deployed open-source server for sharing and editing geospatial data. The flaw is an SQL injection that, critically, can be escalated to unauthenticated remote code execution — the worst-case combination for an internet-facing application. There is no patch available at the time of writing, which means every exposed GeoServer instance is a live target right now.
GeoServer is not niche software. It is embedded in government GIS portals, utilities, logistics platforms, defense mapping systems, and environmental data infrastructure worldwide. It is frequently deployed directly on the internet, often on default ports (8080), and historically under-monitored because it sits outside traditional IT asset inventories. That profile — high-value data, broad deployment, weak visibility — is exactly why attackers are moving on this flaw before a fix exists.
If you run GeoServer anywhere in your estate, treat this as an active incident condition until you have confirmed compensating controls are in place. This is not a "patch next cycle" event.
Technical Analysis
Affected Product and Exposure
- Product: GeoServer (OSGeo project), a Java-based server implementing OGC standards (WFS, WMS, WCS) for geospatial data publishing
- Vulnerability class: SQL injection (CWE-89) chained to unauthenticated remote code execution
- Authentication requirement: None — exploitation is possible by any unauthenticated remote attacker who can reach the service
- Typical deployment: Apache Tomcat or embedded Jetty, commonly on TCP/8080 or behind a reverse proxy on 80/443; runs on both Linux and Windows hosts
No CVE identifier has been formally assigned in the reporting available at publication, and no fixed version has been released. Defenders should track the GeoServer project (geoserver.org), the OSGeo issue tracker, and CISA's Known Exploited Vulnerabilities catalog for assignment and remediation guidance.
How the Attack Works — Defender's View
SQL injection in GeoServer is particularly dangerous because of how the application processes OGC service requests. GeoServer accepts filter expressions (CQL/ECQL and OGC XML filters) via WFS/WMS query parameters — for example, the CQL_FILTER parameter on GetFeature requests. These filters are evaluated and, in certain code paths, translated into SQL executed against the backend data store. When input validation fails, attacker-controlled filter expressions escape into the SQL context.
From injection to code execution, the realistic chain looks like this:
- Reconnaissance: Attacker scans for GeoServer's characteristic endpoints —
/geoserver/web/,/geoserver/ows?service=WFS&request=GetCapabilities, or the login page on port 8080. - Injection: A crafted OGC/CQL filter expression is submitted through an unauthenticated service request, injecting SQL into the query executed against the configured data store.
- Escalation: Depending on the backend database and its privileges, the attacker leverages database-native capabilities for code execution — for example, writing files via database functions or invoking OS command execution features (such as
xp_cmdshellon MSSQL-backed stores orCOPY ... TO PROGRAMon PostgreSQL with superuser context), or pivoting to in-process execution through the application's own expression evaluation. - Post-exploitation: The attacker drops a web shell into the Tomcat webapps directory, establishes a reverse shell, or deploys persistence. Because GeoServer runs as a service account (often with broad filesystem and database access), the blast radius is significant.
The key takeaway for detection engineering: exploitation generates observable web requests containing SQL syntax in OGC filter parameters and, on success, the Java/Tomcat process spawning unexpected child processes or writing executable content into web-accessible directories.
Exploitation Status
- In-the-wild exploitation: Confirmed — the reporting explicitly describes active attacks against unpatched instances.
- Patch availability: None at time of writing. This is a true zero-day condition.
- CISA KEV: Monitor for addition; given confirmed exploitation of an internet-facing application, KEV listing is a realistic near-term outcome.
Assume any internet-reachable GeoServer instance has already been scanned and possibly probed. Hunt retroactively.
Detection & Response
Because the attack surface is the OGC service layer, detection must cover both the network/web tier (malicious filter parameters) and the host tier (post-exploitation behavior from the Java process). Deploy all of the following.
Sigma Rules
---
title: GeoServer OGC Filter SQL Injection Attempt in Web Request
id: 3f8c1a92-7d54-4b6e-9a21-5c0e8f2b3d47
status: experimental
description: Detects SQL injection syntax within GeoServer OGC service parameters (CQL_FILTER, FILTER, OGC filter bodies) in web server or proxy logs, consistent with reported in-the-wild exploitation of the unpatched GeoServer SQL injection flaw.
references:
- https://www.securityweek.com/hackers-exploiting-unpatched-geoserver-zero-day/
- https://attack.mitre.org/techniques/T1190/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
product: apache
detection:
selection_uri:
cs-uri|contains:
- '/geoserver/'
selection_param:
cs-uri-query|contains:
- 'CQL_FILTER'
- 'cql_filter'
- 'FILTER='
- 'filter='
selection_sqli:
cs-uri-query|contains:
- "' OR "
- "' or "
- 'UNION SELECT'
- 'union select'
- 'SLEEP('
- 'BENCHMARK('
- 'PG_SLEEP'
- 'xp_cmdshell'
- 'COPY%20'
- '%20OR%201%3D1'
- '--'
- 'extractvalue'
- 'updatexml'
condition: selection_uri and selection_param and selection_sqli
falsepositives:
- Legitimate complex CQL filters are rare but possible; validate against known application query patterns
level: high
---
title: Java or Tomcat Process Spawning Shell or Command Interpreter
id: 9b2e4d71-3c86-4f19-a8d5-6e1c7b0a2f93
status: experimental
description: Detects the GeoServer Java/Tomcat process spawning command interpreters or shells, a strong post-exploitation signal following successful SQL injection to code execution. GeoServer should never legitimately spawn cmd.exe, powershell.exe, sh, or bash.
references:
- https://www.securityweek.com/hackers-exploiting-unpatched-geoserver-zero-day/
- https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.execution
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection_parent:
ParentImage|endswith:
- '\java.exe'
- '\javaw.exe'
- '\tomcat9.exe'
- '\tomcat8.exe'
- '\commons-daemon.exe'
selection_child:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
- '\pwsh.exe'
- '\wscript.exe'
- '\cscript.exe'
- '\rundll32.exe'
- '\certutil.exe'
- '\bitsadmin.exe'
- '\curl.exe'
- '\wget.exe'
- '\whoami.exe'
- '\net.exe'
- '\nltest.exe'
condition: selection_parent and selection_child
falsepositives:
- Custom GeoServer extensions invoking external tools (e.g., GDAL utilities) — baseline your environment and tune by child image
level: critical
---
title: Executable Content Written to Tomcat Webapps Directory
id: 5d1a7c38-2e94-4b07-b3c6-8f0a4d9e1c52
status: experimental
description: Detects creation of JSP, WAR, or script files in Tomcat/GeoServer web application directories, consistent with web shell deployment following successful exploitation of the GeoServer injection flaw.
references:
- https://www.securityweek.com/hackers-exploiting-unpatched-geoserver-zero-day/
- https://attack.mitre.org/techniques/T1505.003/
author: Security Arsenal
date: 2026/01/15
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: windows
detection:
selection_path:
TargetFilename|contains:
- '\webapps\'
- '\tomcat\'
- '\geoserver\'
selection_ext:
TargetFilename|endswith:
- '.jsp'
- '.jspx'
- '.war'
- '.aspx'
- '.php'
- '.jspf'
condition: selection_path and selection_ext
falsepositives:
- Legitimate application deployment or GeoServer updates — correlate with change windows and deployment tooling
level: high
KQL — Microsoft Sentinel / Defender
GeoServer hosts are frequently Linux-based. The queries below cover both Windows endpoints via Defender telemetry and Linux/network telemetry ingested through Syslog/CEF (e.g., from a reverse proxy, WAF, or Apache/Nginx access logs forwarded to Sentinel).
// Hunt 1: SQLi patterns in GeoServer OGC filter parameters (proxy/WAF logs via CEF or Syslog)
CommonSecurityLog
| where TimeGenerated > ago(14d)
| where RequestURL contains "/geoserver/" or RequestURL contains "CQL_FILTER" or RequestURL contains "GetFeature"
| where RequestURL has_any ("UNION SELECT", "union select", "' OR ", "xp_cmdshell", "PG_SLEEP", "SLEEP(", "extractvalue", "updatexml", "%20OR%201%3D1", "BENCHMARK(")
| project TimeGenerated, SourceIP, DestinationIP, RequestURL, RequestMethod, ApplicationProtocol, DeviceVendor
| sort by TimeGenerated desc
// Hunt 2: Java/Tomcat spawning command interpreters (Windows endpoints)
DeviceProcessEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "tomcat9.exe", "tomcat8.exe")
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "bitsadmin.exe", "curl.exe", "whoami.exe", "net.exe")
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName
| sort by TimeGenerated desc
// Hunt 3: Linux Syslog — shells or suspicious child activity on GeoServer hosts
Syslog
| where TimeGenerated > ago(14d)
| where Computer has_any ("geoserver", "gis", "tomcat") // tune to your host naming
| where SyslogMessage has_any ("/bin/sh", "/bin/bash", "bash -i", "nc -e", "curl ", "wget ", "chmod +x", "/tmp/", "base64 -d")
| project TimeGenerated, Computer, ProcessName, SyslogMessage, HostIP
| sort by TimeGenerated desc
// Hunt 4: Outbound connections from the GeoServer process to unusual destinations
DeviceNetworkEvents
| where TimeGenerated > ago(14d)
| where InitiatingProcessFileName in~ ("java.exe", "javaw.exe", "tomcat9.exe")
| where RemotePort in (80, 443, 8080, 4444, 53) == false or RemoteIPType == "Public"
| where RemoteUrl !has_any ("openstreetmap", "osgeo", "maven") // tune known-good geospatial endpoints
| summarize Connections = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by DeviceName, RemoteIP, RemotePort, RemoteUrl
| sort by Connections desc
Velociraptor VQL
Use this hunt artifact across your GeoServer fleet to identify post-exploitation artifacts: Java-spawned shells, recently written executable content in web directories, and unexpected network listeners.
-- Hunt: GeoServer post-exploitation artifacts (shells spawned by Java, web shells in webapps, anomalous connections)
-- Artifact: Custom.Hunt.GeoServerZeroDay
-- Part 1: Java/Tomcat processes with suspicious children or command lines
SELECT Pid, Ppid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)java|tomcat'
AND (CommandLine =~ '(?i)cmd\.exe|powershell|/bin/sh|/bin/bash|-c '
OR Exe =~ '(?i)tomcat|geoserver')
-- Part 2: Recently created web-executable files in Tomcat/GeoServer paths (adjust glob for your layout)
SELECT FullPath, Size, Mtime, Ctime
FROM glob(globs=['/var/lib/tomcat*/webapps/**/*.jsp', '/opt/tomcat*/webapps/**/*.jsp',
'/usr/share/tomcat*/webapps/**/*.jsp', 'C:/Program Files*/Apache*/Tomcat*/webapps/**/*.jsp'])
WHERE Mtime > now() - 1209600
-- Part 3: Network connections from Java processes
SELECT Pid, Name, Status, Laddr, Raddr
FROM netstat()
WHERE Name =~ '(?i)java'
AND Status =~ 'ESTABLISHED|LISTEN'
Bash Verification and Hardening Script
Run this on Linux GeoServer hosts to inventory exposure, check for signs of compromise, and apply emergency network-level hardening while awaiting a vendor patch.
#!/usr/bin/env bash
# GeoServer zero-day emergency triage and hardening script
# Run as root on suspected GeoServer hosts
set -euo pipefail
REPORT="/root/geoserver_triage_$(date +%Y%m%d_%H%M%S).log"
exec > >(tee -a "$REPORT") 2>&1
echo "=== GeoServer Zero-Day Triage — $(hostname) — $(date) ==="
# 1. Identify running GeoServer/Tomcat processes and listening ports
echo "--- Java/Tomcat processes ---"
ps -eo pid,user,cmd | grep -Ei 'java|tomcat|geoserver' | grep -v grep || echo "None found"
echo "--- Listening ports ---"
ss -tlnp | grep -Ei 'java|:8080|:8443' || echo "No GeoServer listeners detected"
# 2. Check whether GeoServer is internet-reachable (egress test is on you; this shows binding)
echo "--- Bind address check: 0.0.0.0 means externally exposed if no firewall ---"
ss -tlnp | grep -E ':8080|:8443' || true
# 3. Hunt for IoCs: suspicious JSP files written recently to webapps
echo "--- Web-executable files modified in last 14 days ---"
find /var/lib/tomcat*/webapps /opt/tomcat*/webapps /usr/share/tomcat*/webapps \
-type f \( -name '*.jsp' -o -name '*.jspx' -o -name '*.war' \) -mtime -14 2>/dev/null || echo "No matches"
# 4. Hunt for shells/tools dropped in temp and writable dirs
echo "--- Suspicious files in /tmp, /dev/shm, /var/tmp (last 14 days) ---"
find /tmp /dev/shm /var/tmp -type f -mtime -14 -executable 2>/dev/null || echo "None"
# 5. Audit access logs for SQLi patterns in OGC filter parameters
echo "--- SQLi patterns in Tomcat/GeoServer access logs ---"
grep -Eih "CQL_FILTER|FILTER=" /var/log/tomcat*/localhost_access_log* /opt/tomcat*/logs/*access* 2>/dev/null \
| grep -Ei "UNION|SELECT|SLEEP|BENCHMARK|xp_cmdshell|PG_SLEEP|extractvalue|updatexml|OR 1=1|--" \
| tail -50 || echo "No injection patterns found in available logs"
# 6. EMERGENCY MITIGATION: Restrict GeoServer to trusted management networks
# Adjust TRUSTED_NET to your actual admin/application-tier CIDR before running
TRUSTED_NET="10.0.0.0/8"
echo "--- Applying iptables restriction on 8080/8443 to $TRUSTED_NET ---"
iptables -C INPUT -p tcp -s "$TRUSTED_NET" --dport 8080 -j ACCEPT 2>/dev/null \
|| iptables -I INPUT -p tcp -s "$TRUSTED_NET" --dport 8080 -j ACCEPT
iptables -C INPUT -p tcp -s "$TRUSTED_NET" --dport 8443 -j ACCEPT 2>/dev/null \
|| iptables -I INPUT -p tcp -s "$TRUSTED_NET" --dport 8443 -j ACCEPT
iptables -C INPUT -p tcp --dport 8080 -j DROP 2>/dev/null \
|| iptables -A INPUT -p tcp --dport 8080 -j DROP
iptables -C INPUT -p tcp --dport 8443 -j DROP 2>/dev/null \
|| iptables -A INPUT -p tcp --dport 8443 -j DROP
echo "--- Verifying rules ---"
iptables -L INPUT -n --line-numbers | grep -E '8080|8443' || true
echo "=== Triage complete. Review $REPORT and escalate findings to IR if IoCs present. ==="
For Windows-hosted GeoServer, the equivalent priorities are: confirm the Tomcat service account is not a local administrator, review C:\Program Files\*Tomcat*\webapps\ for recently modified JSP files, check Tomcat access logs for the injection patterns in the Sigma rule above, and restrict inbound 8080/8443 via Windows Firewall to application-tier hosts only.
Remediation
With no vendor patch currently available, remediation is about compensating controls and exposure elimination, executed in this order:
-
Inventory and isolate immediately. Identify every GeoServer instance in your environment — including shadow IT, cloud images, containers (
docker searchyour registries for GeoServer-based images), and instances embedded in vendor GIS products. Any instance reachable from the internet should be pulled behind a VPN, IP allowlist, or identity-aware proxy today. If the data it serves is not mission-critical, take it offline until patched. -
Apply network-layer restrictions. GeoServer's OGC endpoints do not need to be open to the world in most architectures. Restrict TCP 8080/8443 to known application-tier and administrative networks at the firewall or security group level. Where GeoServer fronts public map services, place it behind a reverse proxy or WAF that blocks requests containing SQL metacharacters in
CQL_FILTER,FILTER, and OGC XML filter bodies. -
Reduce the code-execution blast radius. The injection-to-RCE chain depends on database privileges. Audit the database accounts GeoServer uses for its data stores: they must be least-privilege read-only where possible, and must not have superuser rights, file-write functions, or command-execution features (disable
xp_cmdshellon MSSQL; ensure PostgreSQL accounts lackpg_read_server_files/pg_write_server_files/pg_execute_server_program). This single step can break the RCE escalation even if injection succeeds. -
Run the service as a dedicated low-privilege account with no shell, no sudo, and write access only to its data directory. Never run GeoServer/Tomcat as root or SYSTEM.
-
Hunt retroactively. Assume probing has already occurred. Run the Sigma, KQL, and VQL content above against at least 30 days of retained web, proxy, and endpoint telemetry. Any hit on injection patterns followed by child-process or file-write activity is a confirmed IR event — preserve memory and disk images before remediation.
-
Monitor for the patch and apply on release. Track the official channels: the GeoServer project site (https://geoserver.org), the OSGeo geoserver GitHub repository and security advisories (https://github.com/geoserver/geoserver/security/advisories), and the CISA KEV catalog (https://www.cisa.gov/known-exploited-vulnerabilities-catalog). Given confirmed in-the-wild exploitation, expect both a rapid vendor fix and a KEV entry with a federal remediation deadline — pre-stage your change window now so the patch deploys within 24-48 hours of release.
-
Validate with offensive testing after patching. Once a fixed version is applied, have your pen-testing team (or ours) attempt the injection vectors against a staging instance to confirm the fix holds, and re-run external attack surface scans to catch any instances your inventory missed.
The pattern here is one we see repeatedly: geospatial and mapping infrastructure is operationally critical but security-invisible. It runs on forgotten VMs, outside EDR coverage, with database accounts provisioned for convenience rather than least privilege. This zero-day is a forcing function — use it to pull GeoServer, and every application like it, into your managed attack surface program permanently.
Related Resources
Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub
Is your security operations ready?
Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.