CVE-2023-24163 Dromara hutool vulnerable to SQL Injection
Attackers can execute arbitrary code via SQL injection in the aviator template engine of the Hutool Java library.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-24163?
CVE-2023-24163 is a critical SQL injection vulnerability in n/a, published on 31 Jan 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQL Inection vulnerability in Dromara hutool before 5.8.21 allows attacker to execute arbitrary code via the aviator template engine.
Weakness: CWE-89
Which versions are affected by CVE-2023-24163?
2 open source packages ship an affected version, including cn.hutool:hutool-all. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
cn.hutool:hutool-all Maven | All versions | 5.8.21 |
cn.hutool:hutool-all Maven | All versions | 5.8.21 |
Products include Hutool Hutool.
How do I fix CVE-2023-24163?
Upgrade cn.hutool:hutool-all to 5.8.21 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2023-24163 being exploited?
There is no known exploitation of CVE-2023-24163 in the wild and no public exploit code.
Other vulnerabilities in n/a
- CVE-2023-42276 hutool Buffer Overflow vulnerability
- CVE-2023-42277 hutool Buffer Overflow vulnerability
- CVE-2023-24162 Dromara Hutool Deserialization of Untrusted Data vulnerability
- CVE-2022-22885 Improper Certificate Validation in Hutool
- CVE-2023-51075 hutool-core discovered to contain an infinite loop in the StrSplitter.splitByRegex function
Sources
Also known as GHSA-6c25-cxcc-pmc4.