CVE-2026-4594: Erupt Framework SQL Injection Vulnerability

CVE-2026-4594 Overview

A SQL injection vulnerability has been identified in the erupts erupt framework affecting versions up to 1.13.3. The vulnerability exists in the geneEruptHqlOrderBy function within the file erupt-data/erupt-jpa/src/main/java/xyz/erupt/jpa/dao/EruptJpaUtils.java. By manipulating the sort.field argument, attackers can inject malicious HQL (Hibernate Query Language) commands, potentially leading to unauthorized database access and data manipulation.

Critical Impact

Remote attackers can exploit this SQL injection vulnerability to bypass authentication, exfiltrate sensitive data, modify database contents, or potentially escalate to further system compromise through database-level attacks.

Affected Products

• erupts erupt versions up to and including 1.13.3
• erupt-jpa module (erupt-data/erupt-jpa component)
• Applications utilizing the EruptJpaUtils.java for HQL query generation

Discovery Timeline

• 2026-03-23 - CVE-2026-4594 published to NVD
• 2026-03-24 - Last updated in NVD database

Technical Details for CVE-2026-4594

Vulnerability Analysis

This vulnerability is classified as CWE-89 (SQL Injection), specifically manifesting through Hibernate Query Language (HQL) injection. The geneEruptHqlOrderBy function in EruptJpaUtils.java fails to properly sanitize user-controlled input passed through the sort.field parameter before incorporating it into dynamically constructed HQL queries.

When applications built on the erupt framework process sorting requests, the sort.field parameter value is directly concatenated into the ORDER BY clause of HQL queries without adequate input validation or parameterization. This allows attackers to break out of the intended query structure and inject arbitrary HQL commands.

The vulnerability is exploitable remotely over the network without requiring authentication or user interaction. The exploit has been publicly disclosed, increasing the risk of active exploitation attempts against vulnerable deployments.

Root Cause

The root cause of this vulnerability is improper input validation and the use of string concatenation to build HQL queries instead of using parameterized queries or prepared statements. The geneEruptHqlOrderBy function directly incorporates the sort.field argument into the query string, trusting that the input represents a legitimate field name when it may contain malicious HQL syntax.

Attack Vector

The attack is network-based and can be initiated remotely against any application exposing the vulnerable functionality. Attackers can craft malicious HTTP requests containing HQL injection payloads in the sort.field parameter. Since the vulnerability exists in the ORDER BY clause construction, attackers can leverage HQL-specific injection techniques to extract data, modify records, or probe the underlying database structure.

The vulnerability does not require authentication, making it accessible to unauthenticated remote attackers. The public disclosure of the exploit details further lowers the barrier to exploitation.

Detection Methods for CVE-2026-4594

Indicators of Compromise

• Unusual or malformed values in HTTP request parameters related to sorting functionality, particularly containing HQL keywords like UNION, SELECT, or subquery syntax
• Database query logs showing unexpected HQL patterns in ORDER BY clauses
• Application errors or exceptions related to HQL parsing failures that may indicate injection attempts
• Anomalous database access patterns or unauthorized data retrieval operations

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block common SQL/HQL injection patterns in request parameters
• Enable detailed application logging for all database query operations, specifically monitoring ORDER BY clause generation
• Deploy runtime application self-protection (RASP) solutions to detect query manipulation at the application layer
• Configure database audit logging to track unusual query patterns and unauthorized data access attempts

Monitoring Recommendations

• Monitor application logs for error messages related to HQL query parsing failures or unexpected query structures
• Set up alerts for high volumes of requests targeting sorting or ordering functionality with varying parameter values
• Implement anomaly detection for database query patterns that deviate from normal application behavior
• Review access logs for reconnaissance patterns that may indicate attackers probing for injection points

How to Mitigate CVE-2026-4594

Immediate Actions Required

• Identify all deployments using erupts erupt versions 1.13.3 and earlier
• Implement input validation to whitelist allowed field names for the sort.field parameter
• Deploy WAF rules to filter potentially malicious HQL injection payloads
• Consider temporarily disabling dynamic sorting functionality if feasible until a permanent fix is applied

Patch Information

At the time of disclosure, the vendor was contacted but did not respond. No official patch is currently available from the vendor. Organizations should monitor the VulDB entry for updates regarding vendor response and patch availability. Additional technical details may be found in the disclosure document.

Workarounds

• Implement strict input validation on the sort.field parameter, allowing only predefined field names from an allowlist
• Modify the application code to use parameterized HQL queries instead of string concatenation for the ORDER BY clause
• Apply network-level controls to restrict access to vulnerable endpoints from untrusted sources
• Consider implementing a custom security filter that sanitizes sorting parameters before they reach the vulnerable function

# Example: Input validation configuration for allowed sort fields
# Add to application configuration to restrict sortable fields
erupt.security.allowedSortFields=id,name,createTime,updateTime
erupt.security.sortFieldValidation=strict