CVE-2024-56158: XWiki Platform SQL Injection Vulnerability

CVE-2024-56158 Overview

CVE-2024-56158 is a critical SQL Injection vulnerability in XWiki, a generic wiki platform. The vulnerability allows attackers to execute arbitrary SQL queries on Oracle databases by exploiting Oracle-specific functions such as DBMS_XMLGEN or DBMS_XMLQUERY. The XWiki query validator fails to properly sanitize these functions when used within simple SELECT statements, and Hibernate permits the use of any native function in HQL queries, creating a dangerous attack surface.

Critical Impact

Unauthenticated attackers can execute arbitrary SQL queries on Oracle databases, potentially leading to complete database compromise, data exfiltration, and unauthorized data manipulation.

Affected Products

• XWiki versions prior to 15.10.16
• XWiki versions 16.0.0 through 16.4.6
• XWiki versions 16.5.0 through 16.10.1

Discovery Timeline

• 2025-06-12 - CVE-2024-56158 published to NVD
• 2026-01-12 - Last updated in NVD database

Technical Details for CVE-2024-56158

Vulnerability Analysis

This SQL Injection vulnerability (CWE-89) arises from insufficient input validation in XWiki's query handling mechanism when interacting with Oracle databases. The platform uses Hibernate ORM for database operations, which supports native SQL functions within HQL (Hibernate Query Language) queries. Oracle databases provide powerful XML generation functions like DBMS_XMLGEN.GETXML() and DBMS_XMLQUERY.GETXML() that can be leveraged to construct and execute arbitrary SQL statements.

The XWiki query validator is designed to sanitize user-controlled input within queries but fails to account for Oracle-specific functions that can encapsulate and execute arbitrary SQL code. Since these functions are valid within HQL syntax and Hibernate does not restrict their usage, attackers can craft malicious queries that bypass the validation layer entirely.

Root Cause

The root cause of this vulnerability is the inadequate sanitization of Oracle-specific database functions within XWiki's query validation mechanism. The validator treats these functions as legitimate query components rather than potential injection vectors. Combined with Hibernate's permissive handling of native database functions in HQL queries, this creates a pathway for attackers to inject and execute arbitrary SQL statements.

Attack Vector

This vulnerability is exploitable over the network without requiring authentication or user interaction. An attacker can send specially crafted requests containing malicious HQL queries that embed Oracle functions like DBMS_XMLGEN.GETXML(). When the XWiki application processes these queries, the embedded SQL commands are executed directly against the Oracle database backend.

The attack flow involves crafting an HQL query that appears valid to XWiki's validator but contains Oracle functions capable of executing arbitrary SQL. For example, DBMS_XMLGEN.GETXML() accepts a SQL query string as a parameter and can be used to execute SELECT, INSERT, UPDATE, or DELETE operations, potentially compromising the entire database.

Detection Methods for CVE-2024-56158

Indicators of Compromise

• HTTP requests containing DBMS_XMLGEN, DBMS_XMLQUERY, or similar Oracle-specific function names in query parameters
• Unusual database query patterns involving XML generation functions in application logs
• Unexpected data access or modification patterns in Oracle database audit logs
• Error messages referencing Oracle XML-related PL/SQL packages in application responses

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block requests containing Oracle-specific function names like DBMS_XMLGEN and DBMS_XMLQUERY
• Enable Oracle database auditing for PL/SQL package executions, particularly for XML-related packages
• Monitor application logs for SQL-related error messages that may indicate injection attempts
• Deploy runtime application self-protection (RASP) solutions to detect anomalous query patterns

Monitoring Recommendations

• Configure alerting on database audit logs for execution of DBMS_XMLGEN or DBMS_XMLQUERY functions from the XWiki application context
• Establish baseline query patterns for XWiki and alert on deviations that include unusual function calls
• Monitor network traffic for requests with abnormally long query strings or encoded SQL syntax
• Review XWiki access logs regularly for suspicious patterns or unauthorized access attempts

How to Mitigate CVE-2024-56158

Immediate Actions Required

• Upgrade XWiki to version 16.10.2, 16.4.7, or 15.10.16 immediately
• If immediate patching is not possible, restrict network access to the XWiki instance using firewall rules
• Implement WAF rules to block requests containing Oracle-specific function names as an interim measure
• Review database access logs for signs of prior exploitation

Patch Information

XWiki has released patched versions that address this vulnerability. Organizations should upgrade to one of the following versions based on their deployment:

• Version 16.10.2 for users on the 16.10.x branch
• Version 16.4.7 for users on the 16.4.x branch
• Version 15.10.16 for users on the 15.10.x LTS branch

The fix is available in commit ce855aae38eefd8ee3fc86353d51ac03d6cb7f8d. For detailed information, refer to the GitHub Security Advisory and the XWiki Issue Tracker.

Workarounds

• Deploy a reverse proxy or WAF configured to filter requests containing DBMS_XMLGEN, DBMS_XMLQUERY, and similar Oracle function names
• If using Oracle, consider restricting the privileges of the database user used by XWiki to limit the impact of potential SQL injection
• Implement network segmentation to isolate the XWiki application and limit lateral movement if compromised
• Enable Oracle Database Vault or similar access control mechanisms to restrict execution of sensitive PL/SQL packages

# Example WAF rule for blocking Oracle function injection attempts
# ModSecurity rule to detect DBMS_XMLGEN/DBMS_XMLQUERY in requests
SecRule REQUEST_URI|ARGS|ARGS_NAMES|REQUEST_BODY "@rx (?i)(DBMS_XMLGEN|DBMS_XMLQUERY)" \
    "id:100001,phase:2,deny,status:403,msg:'Potential Oracle SQL Injection Attempt'"