CVE-2021-43822 SQL injection in jackalope/jackalope-doctrine-dbal
Attackers can execute arbitrary SQL commands via crafted node names or queries in Jackalope Doctrine-DBAL, potentially compromising database integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2021-43822?
CVE-2021-43822 is a high-severity SQL injection vulnerability in jackalope-doctrine-dbal, published on 13 Dec 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.
Weakness: CWE-89
Which versions are affected by CVE-2021-43822?
2 open source packages ship an affected version, including jackalope/jackalope-doctrine-dbal. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
jackalope/jackalope-doctrine-dbal Packagist | All versions | 1.7.4 |
jackalope/jackalope-doctrine-dbal Packagist | All versions | 1.7.4 |
Products include Jackalope Doctrine-Dbal Project Jackalope Doctrine-Dbal.
How do I fix CVE-2021-43822?
Upgrade jackalope/jackalope-doctrine-dbal to 1.7.4 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2021-43822 being exploited?
There is no known exploitation of CVE-2021-43822 in the wild and no public exploit code.
Sources
Also known as GHSA-ph98-v78f-jqrm.