PT-2021-23957 · Unknown · Jackalope Doctrine-Dbal

Alexander-Schranz · Published 2021-12-13 · Updated 2021-12-17 · CVE-2021-43822

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Jackalope Doctrine-DBAL versions prior to 1.7.4

Description: The issue allows users to provoke SQL injections if they can specify a node name or query. This is because the jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths. Node names and xpaths can contain " or ; according to the JCR specification. If queries are never done from user input, or if you validate the user input to not contain ;, you are not affected.

Recommendations: Upgrade to version 1.7.4 to resolve this issue. If that is not possible, escape all places where $property is used to filter sv:name in the class JackalopeTransportDoctrineDBALQueryQOMWalker: XPath::escape($property). As a temporary workaround, consider validating user input to not contain ; to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2021-43822

GHSA-PH98-V78F-JQRM

Affected Products

Jackalope Doctrine-Dbal

References · 7

• https://github.com/jackalope/jackalope-doctrine-dbal/commit/9d179a36d320330ddb303ea3a7c98d3a33d231db · Patch
• https://osv.dev/vulnerability/GHSA-ph98-v78f-jqrm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43822 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43822 · Vendor Advisory
• https://github.com/jackalope/jackalope-doctrine-dbal/security/advisories/GHSA-ph98-v78f-jqrm · Note
• https://github.com/jackalope/jackalope-doctrine-dbal · Note
• https://t.me/cibsecurity/33883 · Telegram Post