xwiki/xwiki-platform · Security
XWiki allows SQL injection in query endpoint of REST API with Oracle
- GHSA ID
- GHSA-prwh-7838-xf82
- CVE ID
- CVE-2024-56158
- Severity
- critical
- Published
- Updated
- CVSS v4
- 9.3 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Description
Impact
It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY.
The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query.
Patches
This has been patched in 16.10.2, 16.4.7 and 15.10.16.
Workarounds
There is no known workaround, other than upgrading XWiki.
References
https://jira.xwiki.org/browse/XWIKI-22734
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
CWEs
- CWE-89 · Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
References
- https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-prwh-7838-xf82 ↗
- https://nvd.nist.gov/vuln/detail/CVE-2024-56158 ↗
- https://jira.xwiki.org/browse/XWIKI-22734 ↗
- https://github.com/xwiki/xwiki-platform/commit/ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d ↗
- https://github.com/advisories/GHSA-prwh-7838-xf82 ↗