CVE-2024-49203: Querydsl SQL/HQL Injection Vulnerability

CVE-2024-49203 Overview

CVE-2024-49203 is a SQL/HQL injection vulnerability affecting Querydsl 5.1.0 and OpenFeign Querydsl 6.8. The vulnerability exists in the orderBy function within JPAQuery, allowing attackers to inject malicious SQL or HQL statements when user-controlled input is passed directly to query construction methods. This vulnerability is disputed by a Querydsl community member who argues that the product is not intended to defend against developers who use untrusted input directly in query construction.

Critical Impact

Applications using Querydsl that pass unsanitized user input to the orderBy method in JPAQuery are vulnerable to SQL/HQL injection, potentially allowing unauthorized data access, modification, or deletion.

Affected Products

• Querydsl 5.1.0
• OpenFeign Querydsl 6.8
• Applications using vulnerable versions with unsanitized user input in query construction

Discovery Timeline

• 2024-11-20 - CVE-2024-49203 published to NVD
• 2025-02-21 - Last updated in NVD database

Technical Details for CVE-2024-49203

Vulnerability Analysis

This vulnerability is categorized as an SQL Injection vulnerability affecting the Querydsl Java library, a popular framework for constructing type-safe SQL-like queries for various backends including JPA, SQL, and MongoDB. The vulnerability specifically manifests in the orderBy method of the JPAQuery class.

When developers pass untrusted user input directly to the orderBy function without proper validation or sanitization, an attacker can inject arbitrary SQL or HQL statements. This occurs because the library does not perform sufficient input validation on the ordering parameters, trusting that developers will only pass safe, validated input.

The dispute surrounding this CVE centers on the design philosophy of Querydsl. Community members argue that the library is designed as a query builder tool, not a security framework, and that responsibility for input validation lies with the application developer rather than the library itself. Regardless of this dispute, the practical security impact remains significant for applications that do not properly sanitize user input before passing it to Querydsl methods.

Root Cause

The root cause of this vulnerability lies in insufficient input sanitization within the orderBy method of the JPAQuery class. When string-based ordering expressions are accepted without proper escaping or parameterization, the library directly incorporates these values into the generated SQL/HQL query. This allows specially crafted input to break out of the intended query context and execute arbitrary database commands.

Attack Vector

An attacker can exploit this vulnerability by supplying malicious input through any application endpoint that uses user-controlled data for query ordering. Common attack vectors include:

1. Sort parameter manipulation: Web applications often expose sorting functionality through URL parameters (e.g., ?sort=name). If this parameter is passed directly to Querydsl's orderBy method, an attacker can inject SQL/HQL payloads.

2. API endpoint exploitation: REST APIs accepting sort or order parameters can be targeted when these values flow directly into query construction.

3. Form field injection: Applications accepting ordering preferences through form submissions without validation are susceptible.

The vulnerability allows attackers to potentially read sensitive data from other database tables, modify or delete data, or in some cases execute administrative operations on the database server. The specific impact depends on the database permissions of the application's database user and the underlying database system.

For technical details on the vulnerability mechanism and proof-of-concept examples, refer to the CSIRT Slovakia advisory and the related GitHub Issue #3757.

Detection Methods for CVE-2024-49203

Indicators of Compromise

• Unusual SQL syntax errors in application logs indicating injection attempts
• Database query logs showing unexpected ORDER BY clauses with subqueries or UNION statements
• Application behavior anomalies when sorting functionality is used with special characters
• Failed authentication or authorization followed by successful data access patterns

Detection Strategies

• Implement SQL injection detection rules in Web Application Firewalls (WAF) to identify malicious ordering parameters
• Enable detailed database query logging to detect anomalous query structures
• Deploy runtime application self-protection (RASP) solutions to monitor query construction in real-time
• Use static application security testing (SAST) tools to identify instances where user input flows to Querydsl orderBy methods

Monitoring Recommendations

• Monitor application logs for SQL syntax errors that may indicate injection attempts
• Set up alerts for unusual database query patterns, particularly those involving ORDER BY with complex expressions
• Track and baseline normal sorting parameter values to detect deviations
• Implement anomaly detection for database access patterns following sort operations

How to Mitigate CVE-2024-49203

Immediate Actions Required

• Audit all code paths where user input is passed to Querydsl orderBy methods
• Implement strict input validation using allowlists for acceptable sort field names
• Upgrade to patched versions: OpenFeign Querydsl 5.6.1 or 6.10.1
• Review and test all sorting functionality in the application for injection vulnerabilities

Patch Information

OpenFeign has released patched versions addressing this vulnerability. Organizations should upgrade to the following versions:

• OpenFeign Querydsl 5.6.1: Release 5.6.1
• OpenFeign Querydsl 6.10.1: Release 6.10.1

Additional context and discussions can be found in Pull Request #742 and Pull Request #743. For applications using the original Querydsl library, monitor the Querydsl GitHub repository for updates.

Workarounds

• Implement a strict allowlist of permitted sort field names and reject any input not on the list
• Use enum-based sorting options in the application layer to prevent arbitrary string input from reaching query construction
• Wrap Querydsl calls with input validation methods that sanitize ordering parameters before use
• Consider using typed path expressions instead of string-based ordering to leverage Querydsl's type-safe features

# Example: Maven dependency update to patched version
# For OpenFeign Querydsl users, update pom.xml:
# <dependency>
#     <groupId>io.github.openfeign.querydsl</groupId>
#     <artifactId>querydsl-jpa</artifactId>
#     <version>6.10.1</version>
# </dependency>

# Verify current Querydsl version in your project
mvn dependency:tree | grep querydsl