Is CVE-2022-24815 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2022-24815 being exploited in the wild.

How severe is CVE-2022-24815?

Low severity, with a CVSS score of 3.1, published 7 April 2022.

Which products and versions are affected?

generator-jhipster (npm) SEMVER:introduced=7.0.0,fixed=7.8.1.

Is there a fix for CVE-2022-24815?

Yes. generator-jhipster (npm): upgrade to 7.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2022-24815 attacked?

It is attacked over the network.

Am I affected by CVE-2022-24815?

Check whether you run generator-jhipster (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2022-24815: JHipster SQL injection in reactive SQL backend entity repositories

CVE-2022-24815 · Severity: low · CVSS 3.1 · Published 2022-04-07

JHipster is a popular code generator for Spring Boot applications. When generating reactive SQL-backed applications using Spring WebFlux, the tool produces repository code that fails to sanitize user input in database queries. An attacker can craft malicious input to the entity query methods to execute arbitrary SQL commands, potentially reading, modifying, or deleting data in the underlying database.

Technologies: generator-jhipster (npm). Vendors: npm.

Quick answers

Is CVE-2022-24815 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2022-24815 being exploited in the wild.
How severe is CVE-2022-24815?: Low severity, with a CVSS score of 3.1, published 7 April 2022.
Which products and versions are affected?: generator-jhipster (npm) SEMVER:introduced=7.0.0,fixed=7.8.1.
Is there a fix for CVE-2022-24815?: Yes. generator-jhipster (npm): upgrade to 7.8.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2022-24815 attacked?: It is attacked over the network.
Am I affected by CVE-2022-24815?: Check whether you run generator-jhipster (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

generator-jhipster (npm): upgrade to 7.8.1 or later
```
npm install generator-jhipster@7.8.1
```

Technical details

This is a SQL injection vulnerability in the findAllBy(Pageable pageable, Criteria criteria) method of generated entity repository classes. The root cause is in EntityManager.java, where the Criteria.toString() output is passed directly to Conditions.just() without sanitization, allowing arbitrary SQL fragments in user-provided Criteria objects. The vulnerability affects applications generated with "reactive with Spring WebFlux" enabled and SQL databases using r2dbc; non-reactive applications and NoSQL backends are unaffected. Gateway applications are vulnerable by default since they are reactive. The attack requires network access to application endpoints that accept Criteria-based queries, with no authentication or user interaction required. Exploitation allows arbitrary SQL execution with the database credentials of the application. The vulnerability was patched in v7.8.1 by removing the findAllBy method and replacing Criteria support with safer Condition objects.

Affected products

JHipster generator-jhipster 7.0.0 to 7.8.0

Identifiers

CVE-2022-24815
GHSA-qjmq-8hjr-qcv6

Timeline

2022-04-07: disclosed
2022-04-07: patched: Fixed in v7.8.1
2022-04-11: advisory: CVE-2022-24815 published to NVD

References

https://github.com/jhipster/generator-jhipster/security/advisories/GHSA-qjmq-8hjr-qcv6

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.