HQL Injection in Erupt through 2.3.0

Executive Summary

This is an HQL (Hibernate Query Language) injection vulnerability in Erupt framework version 2.3.0. It allows authenticated users with query permissions to bypass tree-scoped data filters by injecting unescaped quotes into the linkTreeVal parameter of the POST /erupt-api/data/table/{erupt} endpoint. Attackers can append always-true OR clauses or boolean subqueries to read data from other mapped entities.

Useful 0 Not Useful 0

Detection Guidance

Check for suspicious POST requests to /erupt-api/data/table/{erupt} with linkTreeVal parameters containing quotes or SQL-like payloads. Inspect logs for HQL injection patterns such as OR clauses or boolean subqueries in queries involving String-keyed tree-scoped entities.

Useful 0 Not Useful 0

Impact Analysis

An attacker with query permissions could access unauthorized data by injecting malicious HQL code. This may lead to data breaches, unauthorized information disclosure, or boolean-based inference attacks across different entities in the database. The impact depends on the application's data sensitivity and access controls.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized data access, violating GDPR's data protection principles and HIPAA's security requirements for protected health information. It may result in non-compliance, legal penalties, reputational damage, and loss of trust due to potential data breaches.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade to a patched version of Erupt beyond 2.3.0. If upgrading is not possible, restrict access to the /erupt-api/data/table/{erupt} endpoint and disable query permissions for low-privilege users. Monitor network traffic for exploitation attempts targeting the linkTreeVal parameter.

Useful 0 Not Useful 0