SQL Injection in JHipster-Generated Reactive Applications

Applications generated by generator-jhipster (versions 7.0.0 through 9.2.0) that utilize the reactive stack (Spring WebFlux and Spring Data R2DBC) contain a critical SQL injection vulnerability. The flaw exists in the EntityManager_reactive.java.ejs template, which improperly handles the sort request parameter provided to paginated entity endpoints. Specifically, the application concatenates user-supplied sort properties directly into the SQL ORDER BY clause without validation or parameter binding. Because the generated code relies on the R2DBC simple query protocol, an attacker can terminate the intended query and inject arbitrary SQL statements, such as UPDATE or DROP TABLE. Authenticated users with low privileges, including those created via self-registration, can successfully exploit this to exfiltrate sensitive data (including password hashes) or destroy database tables, resulting in total loss of confidentiality, integrity, and availability for the backend database.

Attack Chain

1. Attacker authenticates to a JHipster-generated reactive application using a low-privileged user account.
2. Attacker identifies a paginated endpoint (e.g., GET /api/products) that utilizes the vulnerable sort query parameter.
3. Attacker crafts a malicious HTTP GET request, injecting SQL metacharacters (e.g., ;, --) into the sort parameter (e.g., ?sort=id;DROP TABLE product;--).
4. The application receives the request and the EntityManager component processes the unsanitized string within createOrderByFields.
5. The backend generates an SQL statement concatenating the malicious string directly into the ORDER BY clause.
6. The R2DBC driver executes the concatenated string as part of a simple query protocol execution.
7. The database executes the injected command, leading to unauthorized data exfiltration, modification, or table deletion.

Impact

The vulnerability allows for arbitrary SQL execution on the database connected to the JHipster-generated application. Observed impacts include the exfiltration of sensitive table data, such as jhi_user password hashes, and the destruction of application data through DROP TABLE commands. The vulnerability affects any reactive monolith or microservice generated by generator-jhipster v7.0.0 through v9.2.0 that uses SQL and pagination.

Recommendation

Prioritize the regeneration of all affected reactive applications using a patched version of generator-jhipster. If an immediate patch for the generator is unavailable, implement input validation logic for the sort parameter to ensure only permitted field names are passed to the EntityManager. Monitor web server logs for HTTP requests to /api/* endpoints containing URL-encoded SQL metacharacters like %3B, %2D%2D, or DROP. Ensure that database service accounts used by these applications follow the principle of least privilege to limit the scope of potential SQL injection impact.