CVE-2021-43822
Description
Jackalope Doctrine-DBAL is an implementation of the PHP Content Repository API (PHPCR) using a relational database to persist data. In affected versions users can provoke SQL injections if they can specify a node name or query. Upgrade to version 1.7.4 to resolve this issue. If that is not possible, you can escape all places where `$property` is used to filter `sv:name` in the class `Jackalope\Transport\DoctrineDBAL\Query\QOMWalker`: `XPath::escape($property)`. Node names and xpaths can contain `"` or `;` according to the JCR specification. The jackalope component that translates the query object model into doctrine dbal queries does not properly escape the names and paths, so that a accordingly crafted node name can lead to an SQL injection. If queries are never done from user input, or if you validate the user input to not contain `;`, you are not affected.
How to fix
- jackalope_doctrine-dbal_project jackalope_doctrine-dbal1.7.4 or later
- jackalope/jackalope-doctrine-dbal1.7.4 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| jackalope_doctrine-dbal_project jackalope_doctrine-dbal | v < 1.7.4 | 1.7.4 |
| jackalope/jackalope-doctrine-dbalPackagist | v < 1.7.4 | 1.7.4 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.