Vulnerability Description
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Jackalope Doctrine-Dbal Project | Jackalope Doctrine-Dbal | < 1.7.4 |
Related Weaknesses (CWE)
References
- https://github.com/jackalope/jackalope-doctrine-dbal/commit/9d179a36d320330ddb30PatchThird Party Advisory
- https://github.com/jackalope/jackalope-doctrine-dbal/security/advisories/GHSA-phMitigationThird Party Advisory
- https://github.com/jackalope/jackalope-doctrine-dbal/commit/9d179a36d320330ddb30PatchThird Party Advisory
- https://github.com/jackalope/jackalope-doctrine-dbal/security/advisories/GHSA-phMitigationThird Party Advisory
FAQ
What is CVE-2021-43822?
CVE-2021-43822 is a vulnerability with a CVSS score of 8.5 (HIGH). Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can sp...
How severe is CVE-2021-43822?
CVE-2021-43822 has been rated HIGH with a CVSS base score of 8.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2021-43822?
Check the references section above for vendor advisories and patch information. Affected products include: Jackalope Doctrine-Dbal Project Jackalope Doctrine-Dbal.