Summary
Flowable's management/tables REST endpoint (GET/POST {root}/management/tables/{tableName}/data) concatenates the orderAscendingColumn and orderDescendingColumn request parameters directly into the SQL ORDER BY clause without validation or parameter binding (order by ${order}). An authenticated (or, depending on deployment, unauthenticated) caller can inject arbitrary SQL expressions, with error responses echoing the fully rendered statement back to the client — enabling error-based/blind data extraction and potentially destructive statements depending on the JDBC driver's statement allowances.
Affected versions
Verified end-to-end on a current Flowable release (live lab reproduction); source-confirmed on current main. The endpoint ships with the standard flowable-rest application.
Proof of Concept (verified on an isolated lab host)
# Boolean differential via CASE WHEN
GET /management/tables/ACT_GE_PROPERTY/data?orderAscendingColumn=(CASE WHEN (1=1) THEN 1 ELSE 1 END)
→ HTTP 200
GET /management/tables/ACT_GE_PROPERTY/data?orderAscendingColumn=(CASE WHEN (1=0) THEN CAST(1/0 AS INT) ELSE 1 END)
→ HTTP 500, error body echoes the fully concatenated "order by CASE WHEN ..." statement (TableData.xml)
# Unauthenticated access is rejected with 401 (boundary confirmed)
Suggested fixes
Validate the order-column parameters against the table's known column names (allow-list) or bind ordering through the persistence layer's identifier quoting; never interpolate request parameters into SQL text.
Coordinated disclosure
We will keep details private until a fix is available (happy to align with your release schedule) and ask for coordinated disclosure of up to 90 days. We found no public advisory or issue covering this injection point.
Summary
Flowable's management/tables REST endpoint (
GET/POST {root}/management/tables/{tableName}/data) concatenates theorderAscendingColumnandorderDescendingColumnrequest parameters directly into the SQLORDER BYclause without validation or parameter binding (order by ${order}). An authenticated (or, depending on deployment, unauthenticated) caller can inject arbitrary SQL expressions, with error responses echoing the fully rendered statement back to the client — enabling error-based/blind data extraction and potentially destructive statements depending on the JDBC driver's statement allowances.Affected versions
Verified end-to-end on a current Flowable release (live lab reproduction); source-confirmed on current
main. The endpoint ships with the standardflowable-restapplication.Proof of Concept (verified on an isolated lab host)
Suggested fixes
Validate the order-column parameters against the table's known column names (allow-list) or bind ordering through the persistence layer's identifier quoting; never interpolate request parameters into SQL text.
Coordinated disclosure
We will keep details private until a fix is available (happy to align with your release schedule) and ask for coordinated disclosure of up to 90 days. We found no public advisory or issue covering this injection point.