CVE-2024-56158: XWiki allows SQL injection in query endpoint of REST API with Oracle
Impact
It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY.
The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query.
Patches
This has been patched in 16.10.2, 16.4.7 and 15.10.16.
Workarounds
There is no known workaround, other than upgrading XWiki.
References
https://jira.xwiki.org/browse/XWIKI-22734
For more information
If you have any questions or comments about this advisory: Open an issue in Jira XWiki.org Email us at Security Mailing List
Other sources
XWiki is a generic wiki platform. It's possible to execute any SQL query in Oracle by using the function like DBMSXMLGEN or DBMSXMLQUERY. The XWiki query validator does not sanitize functions that would be used in a simple select and Hibernate allows using any native function in an HQL query. This vulnerability is fixed in 16.10.2, 16.4.7, and 15.10.16.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-56158?
CVE-2024-56158 is classified as a critical vulnerability due to its potential to execute arbitrary SQL queries.
What software versions are affected by CVE-2024-56158?
CVE-2024-56158 affects XWiki versions between 15.10.16 and 16.10.2, and 16.0.0-rc-1 to 16.4.7.
How do I fix CVE-2024-56158?
To mitigate CVE-2024-56158, upgrade your XWiki installation to the recommended versions 15.10.16, 16.4.7, or 16.10.2.
What is the impact of CVE-2024-56158?
CVE-2024-56158 allows unauthorized users to execute any SQL query against the Oracle database via unverified functions.
Is CVE-2024-56158 related to SQL injection vulnerabilities?
Yes, CVE-2024-56158 can be exploited similarly to SQL injection vulnerabilities, enabling unauthorized database access.