PT-2024-28616 · Hibernate · Hibernate

Hazzik · Published 2024-07-08 · Updated 2024-11-14 · CVE-2024-39677

Positive Technologies (AI Summary)

CVSS v4.0

8.2

High

Base vector

AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions NHibernate versions prior to 5.4.9 NHibernate versions prior to 5.5.2

Description A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. This vulnerability affects callers of these methods, including mappings using inheritance with discriminator values, HQL queries referencing a static field of the application, users of the SqlInsertBuilder and SqlUpdateBuilder utilities, and any direct use of the ObjectToSQLString methods for building SQL queries on the user side.

Recommendations For NHibernate versions prior to 5.4.9, update to version 5.4.9 or later to resolve the issue. For NHibernate versions prior to 5.5.2, update to version 5.5.2 or later to resolve the issue. As a temporary workaround, ensure the application does not use the features listed above, such as mappings using inheritance with discriminator values and HQL queries referencing a static field of the application. For discriminator usages, ensure the discriminator values in the mappings do not contain quotes for string discriminators, and ensure the used values cannot allow culture exploits. Consider restricting the use of the SqlInsertBuilder and SqlUpdateBuilder utilities until the issue is resolved.

Exploit

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2024-39677

GHSA-FG4Q-CCQ8-3R5Q

Affected Products

Hibernate

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/39xxx/CVE-2024-39677.json · Exploit
• https://github.com/nhibernate/nhibernate-core/security/advisories/GHSA-fg4q-ccq8-3r5q · Vendor Advisory
• https://github.com/nhibernate/nhibernate-core/pull/3547 · Patch
• https://github.com/nhibernate/nhibernate-core/commit/b4a69d1a5ff5744312478d70308329af496e4ba9 · Patch
• https://osv.dev/vulnerability/CVE-2024-39677 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-39677 · Security Note
• https://osv.dev/vulnerability/GHSA-fg4q-ccq8-3r5q · Vendor Advisory
• https://github.com/nhibernate/nhibernate-core/pull/3517 · Note
• https://github.com/nhibernate/nhibernate-core/issues/3516 · Note
• https://github.com/nhibernate/nhibernate-core · Note
• https://twitter.com/ynsmroztas/status/1855215734579744988 · Twitter Post
• https://t.me/cvedetector/183 · Telegram Post
• https://twitter.com/RootMoksha/status/1857048916975378523 · Twitter Post
• https://twitter.com/CVEnew/status/1810331891523805390 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1810352953196155360 · Twitter Post