Hibernate ORM up to 5.3.17/5.4.17 JPA Criteria API sql injection

Summaryinfo

A vulnerability classified as critical was found in Hibernate ORM up to 5.3.17/5.4.17. Impacted is an unknown function of the component JPA Criteria API. The manipulation results in sql injection. This vulnerability was named CVE-2019-14900. The attack may be performed from remote. There is no available exploit. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Hibernate ORM up to 5.3.17/5.4.17. It has been classified as critical. Affected is an unknown function of the component JPA Criteria API. The manipulation with an unknown input leads to a sql injection vulnerability. CWE is classifying the issue as CWE-89. The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

A flaw was found in Hibernate ORM in versions before 5.3.18, 5.4.18 and 5.5.0.Beta1. A SQL injection in the implementation of the JPA Criteria API can permit unsanitized literals when a literal is used in the SELECT or GROUP BY parts of the query. This flaw could allow an attacker to access unauthorized information or possibly conduct further attacks.

The weakness was presented 07/07/2020 as Bug 1666499 as not defined bug report (Bugzilla). The advisory is shared for download at bugzilla.redhat.com. This vulnerability is traded as CVE-2019-14900 since 08/10/2019. It is possible to launch the attack remotely. The successful exploitation requires a authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1505.

Upgrading to version 5.3.18, 5.4.18 or 5.5.0.Beta1 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Vendor

• Hibernate

Name

• ORM

Version

• 5.3.0
• 5.3.1
• 5.3.2
• 5.3.3
• 5.3.4
• 5.3.5
• 5.3.6
• 5.3.7
• 5.3.8
• 5.3.9
• 5.3.10
• 5.3.11
• 5.3.12
• 5.3.13
• 5.3.14
• 5.3.15
• 5.3.16
• 5.3.17
• 5.4.0
• 5.4.1
• 5.4.2
• 5.4.3
• 5.4.4
• 5.4.5
• 5.4.6
• 5.4.7
• 5.4.8
• 5.4.9
• 5.4.10
• 5.4.11
• 5.4.12
• 5.4.13
• 5.4.14
• 5.4.15
• 5.4.16
• 5.4.17

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion