HQL Injection in LogicalDOC Community Edition

Executive Summary

LogicalDOC Community Edition through 9.3 has an HQL injection vulnerability in DocumentsDataServlet. Authenticated users can manipulate queries via an unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, allowing them to list restricted document metadata and extract database contents.

Useful 0 Not Useful 0

Detection Guidance

To detect this HQL injection vulnerability in LogicalDOC Community Edition, inspect HTTP requests to the DocumentsDataServlet endpoint for the 'indexed' parameter in documents.xml. Check if user input is directly concatenated into HQL queries without sanitization. Look for boolean HQL expressions in folder scope bypass attempts. Review server logs for unusual query patterns or unauthorized data access.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows attackers with basic access to read restricted documents, view sensitive metadata, and extract database contents. It compromises data confidentiality by bypassing permission checks, potentially exposing confidential or regulated information.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability can lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's confidentiality requirements. It may result in data breaches, non-compliance penalties, and loss of trust due to unauthorized exposure of personal or health information.

Useful 0 Not Useful 0

Mitigation Strategies

Update LogicalDOC Community Edition to version 9.3 or later to address the HQL injection vulnerability in DocumentsDataServlet.

Useful 0 Not Useful 0