High, CVSS 8.2NuGetPublished
NHibernate SQL injection vulnerability in discriminator mappings, static fields referenced in HQL, and some utilities
CVE-2024-39677 · GHSA-fg4q-ccq8-3r5q
- Affected
- NuGet nhibernate < 5.4.9; >= 5.5.0, < 5.5.2
- Fixed in
- 5.4.95.5.2· Vendor fix available
- Issue
- Impact A SQL injection vulnerability exists in some types implementing ILiteralType.ObjectToSQLString. Callers of these methods are exposed to the vulnerability, which includes: - Mappings using inheritance with discriminator values: - The discriminator value could be written in the mapping in a way exploiting the vulnerability of the associated discriminator type, if that type is among the vulnerable ones. - The current culture settings for formatting the discriminator value type could be altered in a way resulting into SQL injections with the discriminator values. - HQL queries referencing a static field of the application. - Users of the SqlInsertBuilder and SqlUpdateBuilder utilities, calling their AddColumn overload taking a literal value. These overloads are unused by NHibernate but could be used by users referencing directly these utilities. - Any direct use of the ObjectToSQLString methods for building SQL queries on the user side. Patches Releases 5.4.9 and 5.5.2.…
Recommended action: Upgrade to 5.5.2 or 5.4.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.