CVE-2024-49203

Overview

Querydsl is an open-source Java framework for building type-safe, SQL-like queries through a fluent API instead of inline query strings. Its modules support several backends, including JPA (querydsl-jpa), SQL (querydsl-sql), MongoDB and Java collections, and its annotation processors (querydsl-apt) generate the query types from domain classes at build time. Querydsl is published to Maven Central under com.querydsl; the OpenFeign continuation of the project publishes its modules under io.github.openfeign.querydsl with its own version numbers.

A SQL injection vulnerability (CVE-2024-49203) has been identified in the JPA query support of Querydsl, which allows attackers to inject HQL/JPQL into the order by clause of a query when an application builds the sort path from an untrusted property name. The CVE record marks this issue as disputed, because Querydsl is not designed to defend against applications that pass untrusted input directly into query construction.

Per OWASP: A SQL injection attack consists of insertion or “injection” of a SQL query via the input data from the client to the application. A successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system. SQL injection attacks are a type of injection attack, in which SQL commands are injected into data-plane input in order to affect the execution of predefined SQL commands.

This issue affects all versions of Querydsl.

Details

Module Info

• Product: Querydsl
• Affected packages: com.querydsl:querydsl-jpa, com.querydsl:querydsl-apt, io.github.openfeign.querydsl:querydsl-jpa, io.github.openfeign.querydsl:querydsl-apt
• Affected versions:
  • com.querydsl:querydsl-jpa: <=5.1.0
  • com.querydsl:querydsl-apt: <=5.1.0
  • io.github.openfeign.querydsl:querydsl-jpa: <5.6.1, >=6.0.0.M1 <6.10.1
  • io.github.openfeign.querydsl:querydsl-apt: <5.6.1, >=6.0.0.M1 <6.10.1
• GitHub repository: https://github.com/querydsl/querydsl
• Published packages: https://central.sonatype.com/artifact/com.querydsl/querydsl-jpa, https://central.sonatype.com/artifact/com.querydsl/querydsl-apt, https://central.sonatype.com/artifact/io.github.openfeign.querydsl/querydsl-jpa, https://central.sonatype.com/artifact/io.github.openfeign.querydsl/querydsl-apt
• Package manager: Maven
• Fixed in:
  • OSS OpenFeign Querydsl 5.6.1, 6.10.1
  • NES for Querydsl v5.1.2

Vulnerability Info

This High-severity vulnerability is found in the com.querydsl:querydsl-jpa package in all versions of Querydsl.

PathBuilder creates query paths from property names given as strings. Applications use it to build dynamic queries, typically by turning a sort parameter from an HTTP request into an OrderSpecifier. Every property name passes through a PathBuilderValidator, and the constructors that take no validator use PathBuilderValidator.DEFAULT, which accepts any name:

PathBuilderValidator DEFAULT = new PathBuilderValidator() {
    @Override
    public Class<?> validate(Class<?> parent, String property, Class<?> propertyType) {
        return propertyType;
    }
};

PathBuilder.get(String) validates the name and then turns it into a property path unchanged:

public PathBuilder<Object> get(String property) {
    // ...
    if (path == null) {
        Class<?> vtype = validate(property, Object.class);
        path = new PathBuilder<Object>(vtype, forProperty(property), validator);
        // ...
    }
    // ...
}

When the query is serialized, the JPQL templates render a property path as {0}.{1s}, which writes the property name into the query string as raw text. A name that contains whitespace and further HQL, for example name INTERSECT SELECT t FROM Test t WHERE ..., therefore becomes part of the order by clause the persistence provider executes. An attacker who controls the sort property can append subqueries, such as the time-based pg_sleep probe on PostgreSQL in the published payload, to infer data the query was never meant to return.

Mitigation

The upstream Querydsl project has published no release since Querydsl 5.1.0 in January 2024, so no com.querydsl release is available to address this issue. For more information, see here.

Users of the affected components should apply one of the following mitigations:

• Migrate affected applications to a release of the OpenFeign continuation of Querydsl (Maven groupId io.github.openfeign.querydsl) that contains the fix, such as 5.6.1 or 6.10.1.
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• CSIRTTrizna from CSIRT.SK (finder)