CVE-2024-49203 Querydsl vulnerable to HQL injection through orderBy
SQL/HQL injection in Querydsl orderBy allows attackers to manipulate database queries if developers use untrusted input directly.
- Exploited in the wild
- Not known
- Login needed
- Not stated
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-49203?
CVE-2024-49203 is a SQL injection vulnerability in n/a, published on 20 Nov 2024. It can be exploited over the network, with no action from the victim.
Official description
Querydsl 5.1.0 and OpenFeign Querydsl 6.8 allows SQL/HQL injection in orderBy in JPAQuery. NOTE: this is disputed by a Querydsl community member because the product is not intended to defend against a developer who uses untrusted input directly in query construction.
Which versions are affected by CVE-2024-49203?
12 open source packages ship an affected version, including io.github.openfeign.querydsl:querydsl-apt, com.querydsl:querydsl-apt and com.querydsl:querydsl-jpa.
| Package | Affected | Fixed in |
|---|---|---|
io.github.openfeign.querydsl:querydsl-apt Maven | All versions | 5.6.1 |
io.github.openfeign.querydsl:querydsl-apt Maven | All versions | 5.6.1 |
io.github.openfeign.querydsl:querydsl-apt Maven | From 6.0.0.M1 | 6.10.1 |
io.github.openfeign.querydsl:querydsl-apt Maven | From 6.0.0.M1 | 6.10.1 |
com.querydsl:querydsl-apt Maven | All versions to 5.1.0 | None |
com.querydsl:querydsl-apt Maven | All versions to 5.1.0 | None |
6 more packages
com.querydsl:querydsl-jpa Maven | All versions to 5.1.0 | None |
com.querydsl:querydsl-jpa Maven | All versions to 5.1.0 | None |
io.github.openfeign.querydsl:querydsl-jpa Maven | All versions | 5.6.1 |
io.github.openfeign.querydsl:querydsl-jpa Maven | All versions | 5.6.1 |
io.github.openfeign.querydsl:querydsl-jpa Maven | From 6.0.0.M1 | 6.10.1 |
io.github.openfeign.querydsl:querydsl-jpa Maven | From 6.0.0.M1 | 6.10.1 |
How do I fix CVE-2024-49203?
Upgrade io.github.openfeign.querydsl:querydsl-apt to a fixed version for your release line: 5.6.1 or 6.10.1.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2024-49203 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-49203 exists.
Sources
Also known as CLSA-2025-1759277170, GHSA-6q3q-6v5j-h6vg, ROOT-APP-MAVEN-CVE-2024-49203.