-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 17.0.0-rc-1, < 17.4.2 | 17.4.2 |
| org.xwiki.platform:xwiki-platform-rest-server | maven | >= 4.3-milestone-1, < 16.10.9 | 16.10.9 |
JavaJavaMiggo AIRoot Cause AnalysisThe vulnerability is an HQL injection flaw within the XWiki Platform's REST API, specifically in functions that handle searching and historical data retrieval. The root cause is the improper construction of HQL queries where user-controlled parameters, orderField and order, were concatenated directly into the query string for sorting purposes without adequate sanitization.
The analysis of the provided patches shows two main areas of weakness:
orderField Injection: In search-related functions like DatabaseKeywordSearchSource.searchPages and DatabaseKeywordSearchSource.searchObjects, the orderField parameter was used to specify a field for sorting. The patch introduced a check to ensure this field name is alphanumeric. Before this, an attacker could supply a malicious HQL snippet in orderField, which would be embedded into the query, leading to arbitrary HQL execution.order Injection: In several resource implementation classes (ModificationsResourceImpl, PageHistoryResourceImpl, PageTranslationHistoryResourceImpl), the order parameter (meant for 'asc' or 'desc') was used directly in the query. The patch replaces the direct usage with a call to a new utility function, HqlQueryUtils.getValidQueryOrder, which strictly validates the input.By identifying the functions where these parameters were used insecurely, we can pinpoint the exact locations in the code that are vulnerable. During an exploit, these functions would be present in the runtime profile as they are responsible for processing the malicious request and constructing the injected HQL query.
Ongoing coverage of React2Shell