XWiki allows SQL injection in query endpoint of REST API with Oracle

The SQL Injection vulnerability in XWiki Platform allows an attacker to leverage functions like DBMSXMLGEN or DBMSXMLQUERY within HQL queries. Because the XWiki query validator fails to sanitize these functions, Hibernate permits their use in native SQL queries. Successful exploitation enables an attacker to bypass security controls and directly interact with the underlying database. This can lead to the extraction of sensitive data, modification of critical system configurations, or even complete system takeover. The potential impact is significant, particularly in environments where XWiki is used to manage sensitive information or integrate with other critical systems.

Organizations using XWiki Platform to manage sensitive data, particularly those running versions prior to 15.10.16, 16.4.7, or 16.10.2, are at significant risk. This includes deployments where XWiki is integrated with other critical systems or used in environments with strict data security requirements. Shared hosting environments where multiple users share the same XWiki instance are also particularly vulnerable.

• java: Monitor XWiki application logs for unusual SQL query patterns, particularly those involving DBMSXMLGEN or DBMSXMLQUERY. Use Java profiling tools to identify any unexpected database interactions. • generic web: Examine access logs for requests targeting vulnerable endpoints. Look for POST requests containing suspicious SQL syntax. • database (oracle): Use Oracle audit trails to monitor for unauthorized database access and execution of suspicious SQL queries. Specifically, look for queries using DBMSXMLGEN or DBMSXMLQUERY from unexpected sources.

SELECT username, os_username, module FROM dba_audit_trail WHERE action_name = 'EXECUTE' AND os_username = '<user_to_monitor>';

1. 2025-06-12Disclosure

   disclosure

1. Reserviert2024-12-17
2. Veröffentlicht2025-06-12
3. Geändert2026-02-03
4. EPSS aktualisiert2026-04-02

The primary mitigation for CVE-2024-56158 is to upgrade XWiki Platform to a patched version: 15.10.16, 16.4.7, or 16.10.2. Unfortunately, there are no known workarounds beyond upgrading. Prior to upgrading, it is crucial to review the XWiki release notes for any potential breaking changes and plan a rollback strategy if necessary. After upgrading, verify the fix by attempting to execute a SQL query through the vulnerable endpoint and confirming that it is properly sanitized and rejected.