GHSA-ph98-v78f-jqrm

Suggest an improvement
Source
https://github.com/advisories/GHSA-ph98-v78f-jqrm
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-ph98-v78f-jqrm/GHSA-ph98-v78f-jqrm.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-ph98-v78f-jqrm
Aliases
Related
Published
2021-12-14T21:08:13Z
Modified
2026-01-30T02:19:05.254835Z
Severity
  • 8.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
SQL injection in jackalope/jackalope-doctrine-dbal
Details

Impact

Users can provoke SQL injections if they can specify a node name or query.

Patches

Upgrade to version 1.7.4

If that is not possible, you can escape all places where $property is used to filter sv:name in the class Jackalope\Transport\DoctrineDBAL\Query\QOMWalker: XPath::escape($property).

Workarounds

Node names and xpaths can contain " or ; according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection.

If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.

References

No further references.

For more information

If you have any questions or comments about this advisory:

Database specific 
{
    "github_reviewed_at": "2021-12-14T15:25:41Z",
    "nvd_published_at": "2021-12-13T20:15:00Z",
    "github_reviewed": true,
    "cwe_ids": [
        "CWE-89"
    ],
    "severity": "HIGH"
}
References

Affected packages

Packagist / jackalope/jackalope-doctrine-dbal

Package

Name
jackalope/jackalope-doctrine-dbal
Purl
pkg:composer/jackalope/jackalope-doctrine-dbal

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.7.4

Affected versions

1.*
1.0.0-alpha1
1.0.0-beta1
1.0.0-beta2
1.0.0-beta3
1.0.0-beta4
1.0.0-RC1
1.0.0-RC2
1.0.0-RC3
1.0.0-RC4
1.0.0
1.1.0-RC1
1.1.0
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.2.0-RC1
1.2.0
1.2.1
1.2.2
1.2.3
1.2.4
1.2.5
1.2.6
1.2.7
1.2.8
1.3.0
1.3.1
1.3.2
1.3.3
1.3.4
1.3.5
1.3.6
1.4.0
1.4.1
1.5.0
1.5.1
1.6.0
1.6.1
1.7.0
1.7.1
1.7.2
1.7.3

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/12/GHSA-ph98-v78f-jqrm/GHSA-ph98-v78f-jqrm.json"