Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a classic SQL injection (specifically, HQL injection) vulnerability within a Velocity template. The root cause is the lack of input validation on the sort parameter in the getdeleteddocuments.vm template. This parameter is taken directly from the user request and embedded into an HQL query string, allowing an attacker to execute arbitrary HQL commands.
The patch addresses this by introducing a new validation mechanism. A new script service, org.xwiki.query.hql.HqlQueryScriptService, with the method checkOrderBySafe, was added. This method, in turn, uses org.xwiki.query.hql.internal.DefaultHQLStatementValidator to ensure the sort parameter's value is safe before being used in the query. The getdeleteddocuments.vm template was modified to call this new validation function. While not a traditional function, the Velocity template getdeleteddocuments.vm is the component that processes the malicious input and is the source of the vulnerability. During exploitation, the rendering process of this template would be a key indicator in a runtime profile.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-distribution-war | maven | >= 9.4-rc-1, < 16.10.6 | 16.10.6 |
| org.xwiki.platform:xwiki-platform-distribution-war | maven | >= 17.0.0-rc-1, < 17.3.0-rc-1 |
| 17.3.0-rc-1 |
