JHipster - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/vendors/jhipster/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 09 Oct 2026 12:48:47 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgMultiple Vulnerabilities in JHipsterhttps://feed.craftedsignal.io/briefs/2026-10-09-jhipster-vulnerabilities/Fri, 09 Oct 2026 12:48:47 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-09-jhipster-vulnerabilities/JHipster is affected by multiple vulnerabilities allowing a remote, authenticated attacker to execute Cross-Site Scripting (XSS) or SQL Injection attacks, compromising application integrity.The BSI has reported multiple vulnerabilities within the JHipster platform. These security flaws allow a remote, authenticated attacker to perform Cross-Site Scripting (XSS) or SQL Injection (SQLi) attacks. These vulnerabilities primarily affect the integrity of applications generated or managed by the JHipster framework. Because these flaws are exploitable by authenticated users, they represent a significant risk to internal security, as malicious actors with low-privileged account access could escalate their impact or perform unauthorized data manipulation. Defenders must audit applications generated with JHipster and ensure they are utilizing patched versions or applying necessary input sanitization and parameterization to mitigate these injection vectors.

Impact

Successful exploitation of these vulnerabilities allows an attacker to inject arbitrary scripts into web pages viewed by other users (XSS) or manipulate backend database queries (SQLi). This can lead to session hijacking, unauthorized access to sensitive application data, and potential full application compromise, depending on the architecture and permissions of the generated application.

Recommendation

Prioritized actions for security and development teams:

  • Inventory all applications currently utilizing JHipster to identify versions exposed to these vulnerabilities.
  • Review and sanitize all application inputs to prevent SQL injection and ensure proper output encoding to block XSS attempts.
  • Monitor web server and application logs for suspicious characters in HTTP parameters, such as script tags or SQL syntax characters.
  • Ensure development teams apply security updates provided by the JHipster project as they become available.
]]>highadvisoryvulnerabilityweb-applicationsql-injectionxssSQL Injection in JHipster-Generated Reactive Applicationshttps://feed.craftedsignal.io/briefs/2026-10-jhipster-sql-injection/Thu, 08 Oct 2026 19:26:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-jhipster-sql-injection/JHipster-generated reactive applications are vulnerable to SQL injection via the 'sort' parameter in paginated endpoints, allowing authenticated attackers to execute arbitrary SQL commands.Applications generated by generator-jhipster (versions 7.0.0 through 9.2.0) that utilize the reactive stack (Spring WebFlux and Spring Data R2DBC) contain a critical SQL injection vulnerability. The flaw exists in the EntityManager_reactive.java.ejs template, which improperly handles the sort request parameter provided to paginated entity endpoints. Specifically, the application concatenates user-supplied sort properties directly into the SQL ORDER BY clause without validation or parameter binding. Because the generated code relies on the R2DBC simple query protocol, an attacker can terminate the intended query and inject arbitrary SQL statements, such as UPDATE or DROP TABLE. Authenticated users with low privileges, including those created via self-registration, can successfully exploit this to exfiltrate sensitive data (including password hashes) or destroy database tables, resulting in total loss of confidentiality, integrity, and availability for the backend database.

Attack Chain

  1. Attacker authenticates to a JHipster-generated reactive application using a low-privileged user account.
  2. Attacker identifies a paginated endpoint (e.g., GET /api/products) that utilizes the vulnerable sort query parameter.
  3. Attacker crafts a malicious HTTP GET request, injecting SQL metacharacters (e.g., ;, --) into the sort parameter (e.g., ?sort=id;DROP TABLE product;--).
  4. The application receives the request and the EntityManager component processes the unsanitized string within createOrderByFields.
  5. The backend generates an SQL statement concatenating the malicious string directly into the ORDER BY clause.
  6. The R2DBC driver executes the concatenated string as part of a simple query protocol execution.
  7. The database executes the injected command, leading to unauthorized data exfiltration, modification, or table deletion.

Impact

The vulnerability allows for arbitrary SQL execution on the database connected to the JHipster-generated application. Observed impacts include the exfiltration of sensitive table data, such as jhi_user password hashes, and the destruction of application data through DROP TABLE commands. The vulnerability affects any reactive monolith or microservice generated by generator-jhipster v7.0.0 through v9.2.0 that uses SQL and pagination.

Recommendation

Prioritize the regeneration of all affected reactive applications using a patched version of generator-jhipster. If an immediate patch for the generator is unavailable, implement input validation logic for the sort parameter to ensure only permitted field names are passed to the EntityManager. Monitor web server logs for HTTP requests to /api/* endpoints containing URL-encoded SQL metacharacters like %3B, %2D%2D, or DROP. Ensure that database service accounts used by these applications follow the principle of least privilege to limit the scope of potential SQL injection impact.

]]>highadvisorysql-injectionweb-vulnerabilitycwe-89