Executive brief
JHipster is a popular code generator for Spring Boot applications. When generating reactive SQL-backed applications using Spring WebFlux, the tool produces repository code that fails to sanitize user input in database queries. An attacker can craft malicious input to the entity query methods to execute arbitrary SQL commands, potentially reading, modifying, or deleting data in the underlying database.
Technical details
This is a SQL injection vulnerability in the findAllBy(Pageable pageable, Criteria criteria) method of generated entity repository classes. The root cause is in EntityManager.java, where the Criteria.toString() output is passed directly to Conditions.just() without sanitization, allowing arbitrary SQL fragments in user-provided Criteria objects. The vulnerability affects applications generated with "reactive with Spring WebFlux" enabled and SQL databases using r2dbc; non-reactive applications and NoSQL backends are unaffected. Gateway applications are vulnerable by default since they are reactive. The attack requires network access to application endpoints that accept Criteria-based queries, with no authentication or user interaction required. Exploitation allows arbitrary SQL execution with the database credentials of the application. The vulnerability was patched in v7.8.1 by removing the findAllBy method and replacing Criteria support with safer Condition objects.
Affected products
- JHipster generator-jhipster 7.0.0 to 7.8.0
Timeline
- 2022-04-07: disclosed
- 2022-04-07: patched: Fixed in v7.8.1
- 2022-04-11: advisory: CVE-2022-24815 published to NVD