Generator Jhipster
Monthly
SQL injection in the generated reactive entity-list endpoints of JHipster-produced applications (generator-jhipster versions 7.0.0 up to, but not including, 9.4.0) lets an authenticated user inject arbitrary SQL through the attacker-controlled `sort` request parameter on `GET /api/<entity>?sort=...` endpoints. Because the generated R2DBC code passes the sort property into the SQL ORDER BY clause unvalidated and unquoted, and the driver runs it over the simple query protocol, semicolon-separated statements are executed as well - enabling reads of sensitive tables such as `jhi_user` password hashes, modification or deletion of data, and table drops (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the app to be the reactive WebFlux + Spring Data R2DBC + SQL stack, and an account is needed, though the default self-registration flow lets a low-privileged one be self-provisioned; the vendor-released fix is version 9.4.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting can occur in applications generated by JHipster before generator-jhipster 9.4.0 and react-jhipster 1.1.0 when an authenticated user stores attacker-controlled Blob content and a companion ContentType in a Blob-bearing entity and a privileged user later opens it through the generated UI. The assessed CVSS is 7.6 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting authenticated write access, required victim interaction, and conditional exploitability that depends on the generated application's CSP and target-browser Blob handling. No public exploit identified at time of analysis; vendor-released patches are generator-jhipster 9.4.0 and react-jhipster 1.1.0.
JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
SQL injection in the generated reactive entity-list endpoints of JHipster-produced applications (generator-jhipster versions 7.0.0 up to, but not including, 9.4.0) lets an authenticated user inject arbitrary SQL through the attacker-controlled `sort` request parameter on `GET /api/<entity>?sort=...` endpoints. Because the generated R2DBC code passes the sort property into the SQL ORDER BY clause unvalidated and unquoted, and the driver runs it over the simple query protocol, semicolon-separated statements are executed as well - enabling reads of sensitive tables such as `jhi_user` password hashes, modification or deletion of data, and table drops (CVSS 3.1 8.8, AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). Exploitation requires the app to be the reactive WebFlux + Spring Data R2DBC + SQL stack, and an account is needed, though the default self-registration flow lets a low-privileged one be self-provisioned; the vendor-released fix is version 9.4.0, and no public exploit code or confirmed active exploitation was identified at time of analysis.
Stored cross-site scripting can occur in applications generated by JHipster before generator-jhipster 9.4.0 and react-jhipster 1.1.0 when an authenticated user stores attacker-controlled Blob content and a companion ContentType in a Blob-bearing entity and a privileged user later opens it through the generated UI. The assessed CVSS is 7.6 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:L/A:N, reflecting authenticated write access, required victim interaction, and conditional exploitability that depends on the generated application's CSP and target-browser Blob handling. No public exploit identified at time of analysis; vendor-released patches are generator-jhipster 9.4.0 and react-jhipster 1.1.0.
JHipster is a development platform to quickly generate, develop, & deploy modern web applications & microservice architectures. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.