Description

Progress MarkLogic Server 12.x releases before 12.1.0 and 11.x releases before 11.3.7 contain an XQuery injection flaw in a deprecated Management API package path. A remote attacker with manage-user-level privileges could exploit this flaw to obtain persistent unauthorized administrative control.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "9.9",
  "pubDate": "2026-10-12T16:17:06.173Z",
  "pubdate": "2026-10-12T16:17:06.173Z",
  "executiveSummary": "Progress MarkLogic Server versions 11.x (prior to 11.3.7) and 12.x (prior to 12.1.0) are susceptible to an XQuery injection vulnerability located within a deprecated Management API package path.\nThe vulnerability allows an authenticated attacker possessing manage-user-level privileges to perform unauthorized administrative actions through the injection of malicious XQuery code.\nSuccessful exploitation results in a total compromise of the affected MarkLogic instance, as the injection allows for the execution of arbitrary commands with administrative authority.\nThis represents a critical risk to data integrity, confidentiality, and system availability, necessitating immediate patching.\nExploitation requires the attacker to possess existing, though limited, manage-user-level credentials, highlighting the necessity of strict identity and access management controls alongside software updates.",
  "technicalDetails": "The vulnerability originates from inadequate input validation and sanitization within a deprecated Management API package path in Progress MarkLogic Server. This failure allows an attacker to break out of the intended query context by injecting arbitrary XQuery expressions into the application's processing logic.\nThe affected versions include 11.x releases prior to 11.3.7 and 12.x releases prior to 12.1.0. The flaw resides within the server-side code responsible for interpreting requests directed at the legacy Management API, which fails to properly neutralize user-supplied input before execution.\nExploitation occurs through a multi-step attack flow: First, an attacker with manage-user-level privileges targets the specific deprecated API endpoint. Second, the attacker crafts a malicious payload containing serialized XQuery instructions designed to manipulate administrative configuration settings or query internal system data.\nBecause the XQuery execution context possesses elevated system permissions, the injected code is processed by the MarkLogic engine as a legitimate administrative request. This effectively bypasses the functional limitations of the standard manage-user role.\nThe post-exploitation impact is severe, enabling an attacker to gain persistent, unauthorized administrative control over the MarkLogic instance. This allows for full database administrative rights, including the modification of security configurations, user account management, data exfiltration, or the potential for complete system takeover.\nThe reliance on a deprecated API component suggests that the underlying input handling mechanisms in that legacy module were not hardened to the same standards as modern interface components, leading to a breakdown in secure development practices regarding input processing.\nNetwork exposure is defined by the availability of the Management API. While authentication is a prerequisite, the vulnerability undermines the intended privilege separation between standard 'manage' roles and 'admin' roles, effectively elevating the attacker's context to the highest level of system authority."
}