Unpatched zero-day probed, what a shock

An unpatched GeoServer zero-day is actively being probed for remote code execution. Because leaving vulnerable databases open to the internet always ends well.

Source: Security Affairs

The Full Story

Severity: High Mood: Frustrating

Here we go again with GeoServer leaving its jsonArrayContains component wide open for unauthorized SQL injection and remote code execution for anyone running privileged database setups. Instead of waiting around for vendor fixes that take an eternity, anyone hosting this joy must immediately hide their exposed instances behind VPNs, reverse proxies, or strict IP allow-lists. It seems expecting software to be secure by default is far too optimistic for our profession.

#PatchTuesday #ZeroDayFatigue

Open article →