Description

LogicalDOC Community Edition through 9.3 contains an HQL injection vulnerability in DocumentsDataServlet that allows authenticated users to manipulate queries via the unvalidated indexed parameter. Attackers with read access to any folder can inject boolean HQL expressions to bypass folder scope and read-permission checks, listing restricted document metadata and extracting database contents.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-10-12T14:17:10.223Z",
  "pubdate": "2026-10-12T14:17:10.223Z",
  "executiveSummary": "LogicalDOC Community Edition versions through 9.3 are susceptible to an HQL (Hibernate Query Language) injection vulnerability located within the DocumentsDataServlet component.\nThis vulnerability stems from the improper sanitization of the 'indexed' parameter, which is processed directly in database queries.\nThe flaw allows an authenticated attacker possessing standard read-level access to manipulate HQL expressions.\nSuccessful exploitation enables the circumvention of folder scoping and document permission checks, leading to unauthorized access to document metadata and the potential extraction of sensitive information from the underlying database.\nThe risk is significant for organizations relying on document-level security controls, as this vulnerability effectively collapses authorization boundaries.\nExploitation requires active authentication, but does not necessitate administrative privileges, making it accessible to any user with baseline access to the application.",
  "technicalDetails": "The vulnerability resides in the DocumentsDataServlet, which fails to validate or parameterize the 'indexed' input parameter before incorporating it into an HQL query executed against the LogicalDOC repository.\nHQL injection occurs when user-supplied input is treated as part of the command structure rather than data, allowing an attacker to alter the query logic. By injecting boolean expressions into the 'indexed' parameter, an attacker can cause the server to evaluate arbitrary conditions.\nThe attack flow initiates when an authenticated user sends a crafted request to the DocumentsDataServlet. By appending malicious HQL operators (e.g., OR, AND, or UNION-like patterns) to the 'indexed' parameter, the attacker can force the backend to bypass standard filtering mechanisms that typically constrain results to folders where the user has read permissions.\nBecause Hibernate translates HQL into SQL, the injected expressions allow for blind or error-based data extraction. An attacker can craft conditions that return true/false responses based on the presence of specific data fields, enabling the systematic enumeration of the database schema and contents.\nThe vulnerability effectively neutralizes the application's access control layer. While the application expects the query to respect folder ownership and user-specific document visibility, the injection allows the attacker to redefine the WHERE clause of the executed query, surfacing documents that should be restricted.\nAffected versions are identified as LogicalDOC Community Edition through version 9.3. The root cause is categorized as improper input validation and the lack of prepared statements or parameter binding when constructing database queries within the servlet layer.\nPost-exploitation, the attacker can leverage the metadata disclosure to identify high-value documents, potentially leading to further data leakage or internal reconnaissance. The exposure is limited to authenticated users; however, in environments with broad user access, the impact on data confidentiality is substantial."
}