Описание
XWiki allows SQL injection in query endpoint of REST API with Oracle
Impact
It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY.
The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query.
Patches
This has been patched in 16.10.2, 16.4.7 and 15.10.16.
Workarounds
There is no known workaround, other than upgrading XWiki.
References
https://jira.xwiki.org/browse/XWIKI-22734
For more information
If you have any questions or comments about this advisory:
- Open an issue in Jira XWiki.org
- Email us at Security Mailing List
Пакеты
org.xwiki.platform:xwiki-platform-oldcore
>= 1.0, < 15.10.16
15.10.16
org.xwiki.platform:xwiki-platform-oldcore
>= 16.0.0-rc-1, < 16.4.7
16.4.7
org.xwiki.platform:xwiki-platform-oldcore
>= 16.5.0-rc-1, < 16.10.2
16.10.2
Связанные уязвимости
XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.
Уязвимость функций DBMS_XMLGEN и DBMS_XMLQUERY платформы создания совместных веб-приложений XWiki Platform XWiki, позволяющая нарушителю выполнить произвольный код