Critical SQL Injection Vulnerability in GeoTools Library

The open-source GeoTools Java library, widely used for geospatial data processing and visualization, contains a critical SQL injection vulnerability (CVSS 9.8). This vulnerability allows unauthenticated attackers to supply malicious input that is executed as part of database queries performed by the library. Depending on the database service permissions, this could result in unauthorized data access, modification, or deletion. In scenarios where the database service runs with elevated privileges, it may lead to full system compromise. The vulnerability is currently being actively scanned by malicious actors, though large-scale exploitation has not yet been reported. Patches are available in versions 33.6, 34.5, and 35.1. Defenders should prioritize auditing systems that utilize GeoTools and apply the recommended version updates immediately.

Impact

Successful exploitation allows attackers to gain unauthorized access to sensitive geospatial data. The potential for server-wide compromise poses significant risks, including data breaches, loss of data integrity, and prolonged service disruption. The threat is elevated due to active scanning activity in the wild.

Recommendation

• Update all instances of GeoTools to versions 33.6, 34.5, or 35.1 immediately to remediate the vulnerability.
• Audit application inventory to identify systems running vulnerable versions of GeoTools.
• Review database service permissions; ensure the database account used by the GeoTools-dependent application follows the principle of least privilege to mitigate the impact of potential command execution.
• Monitor application logs for abnormal database query patterns, such as unexpected SQL syntax characters (e.g., ;, --, OR 1=1) originating from external user inputs.