Description
Erupt through 2.3.0 contains an HQL injection vulnerability that allows authenticated users to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of POST /erupt-api/data/table/{erupt}. Attackers holding query permission on entities with String-keyed linkTree targets can append always-true OR clauses or boolean subqueries to read data from other mapped entities.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
erupts erupt
Default version status: unaffected
0 to ≤ 2.3.0affected
pkg:maven/xyz.erupt/erupt-coreReferences
- https://hackmd.io/m0EK1XcGQfua6QHIXXNqMQ ↗
- https://github.com/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/service/EruptService.java#L62-L71 ↗
- https://github.com/erupts/erupt/blob/2.3.0/erupt-core/src/main/java/xyz/erupt/core/util/TypeUtil.java#L107-L115 ↗
- https://github.com/erupts/erupt/blob/2.3.0/erupt-data/erupt-data-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java#L210-L212 ↗
- https://github.com/erupts/erupt ↗
- https://www.vulncheck.com/advisories/erupt-through-2.3.0-hql-injection-via-linktreeval-in-data-table-api ↗