The GeoServer zero-day, explained.

Transcript

The bug is one unescaped argument. GeoServer's jsonArrayContains function writes its third argument straight into generated SQL without escaping it. So anyone who can send a map filter to the server can send SQL instead. No login needed. Rated nine point eight, with a path to remote code execution on some deployments. But the severity is not what makes this one urgent. The sequence is. It was published publicly on August twelfth, before any patch existed, and exploitation attempts started within hours. Fixes are out now, in three point zero point one, two point twenty eight point five, and two point twenty seven point six. So patching is the easy half. The hard half is that attacks began during a window when nothing could be done, which means patching now closes the door without telling you whether anyone already walked through it. Pull your access logs from the twelfth and go look.