Attackers Exploit GeoServer jsonArrayContains Zero-Day

Threat actors began targeting an unpatched SQL injection vulnerability in GeoServer hours after researcher q1uf3ng disclosed the flaw on Wednesday. WatchTowr, an attack-surface management firm, reported hundreds of probe attempts against the defect.

The flaw affects GeoServer’s jsonArrayContains filter expression, which queries JSON array fields for specific values. It can be triggered when GeoServer is configured to use PostGIS or Oracle JDBC data stores. The researcher reported that user-supplied arguments are not properly sanitized before being embedded in SQL queries, and certain configurations can allow an attacker to achieve remote code execution.

WatchTowr detected exploitation attempts within hours of the disclosure and traced hundreds of probes to a small set of source IP addresses. The company described the activity as automated scanning for vulnerable endpoints rather than confirmed follow-up compromise. Jake Knott of WatchTowr warned, “Within hours of public disclosure, we observed exploitation attempts and recorded hundreds of probes from a small group of IP addresses.”

No official patch was available at the time of the report. WatchTowr advised operators to locate any publicly exposed GeoServer instances, restrict public access, monitor logs for unusual query patterns, and apply network-level controls while awaiting a vendor fix.

GeoServer is an open source platform used to share and process geospatial data across government, agriculture, telecommunications and transit agencies. Multiple past GeoServer vulnerabilities have been listed in the U.S. Cybersecurity and Infrastructure Security Agency’s Known Exploited Vulnerabilities catalog.

So far the observed activity consists of probing rather than confirmed post-exploitation such as data theft or malware deployment. Operators should scan environments for jsonArrayContains usage with PostGIS or Oracle JDBC and follow the mitigation steps until a patch is released.