-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 1.8, < 15.10.16 | 15.10.16 |
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 16.0.0-rc-1, < 16.4.6 | 16.4.6 |
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 16.5.0-rc-1, < 16.10.1 | 16.10.1 |
Miggo AIRoot Cause AnalysisThe vulnerability is an SQL injection in the HQL query endpoint of the XWiki REST API. The analysis focused on the provided commit 5c11a874bd24a581f534d283186e209bbccd8113.
DefaultQueryResource.getResults (inferred from the vulnerability path /rest/wikis/xwiki/query and the patch to AbstractDatabaseSearchSource.java which is in the same REST server module), is the entry point that processes the malicious 'q' parameter from the user.com.xpn.xwiki.store.hibernate.query.HqlQueryExecutor. The execute method within this class is where the (potentially malicious) HQL query is run. The patch modifies the timing and context of checks within this method.isSafeSelect method in HqlQueryExecutor was responsible for validating the HQL query. Its previous implementation was insufficient and directly contributed to the vulnerability by allowing malicious queries to pass as safe. The patch completely overhauled its validation logic.
These functions would appear in a runtime profile during exploitation: the REST method receives the input, and HqlQueryExecutor.execute (which internally relies on the logic previously in isSafeSelect for validation) executes it.Ongoing coverage of React2Shell