Summary
A high-severity SQL injection vulnerability in the Y9 WorkFlow-Engine OAuth2 Resource Filter allows attacker-controlled values to influence database queries in getByIdAndYear.
A remotely reachable request may exploit the year or processInstanceId parameters when they are incorporated into SQL without sufficient parameterization or validation.
Affected context
The vulnerability occurs in WorkFlow-Engine deployments up to the affected release range when the OAuth2 Resource Filter invokes CustomHistoricProcessServiceImpl.getByIdAndYear. Risk is present where remotely supplied year or processInstanceId values reach database query construction without reliable separation from SQL syntax.
Exploit preconditions
- Attack surface: A remotely reachable application endpoint handled by the OAuth2 Resource Filter
- Required access: Network access to the relevant request path; authentication requirements depend on deployment and endpoint policy
- Trigger point: Processing of the
yearorprocessInstanceIdarguments bygetByIdAndYear - Why exploitation is possible: Two independent input positions may be injectable when attacker-controlled values are incorporated into SQL without parameterized query handling
Why this happens
The underlying bug is an injection flaw in database query construction. Input values associated with year and processInstanceId are not consistently treated as data before being used by the query layer, allowing SQL syntax to be interpreted as part of the statement.
This maps primarily to CWE-89: Improper Neutralization of Special Elements used in an SQL Command (SQL Injection). The related CWE-74 classification reflects the broader failure to separate untrusted input from an interpreted command language.
Potential impact
- An attacker may read unauthorized database records
- An attacker could alter, delete, or corrupt workflow-related data
- Database accounts or application data may be exposed
- The application may experience service disruption
- Further compromise could occur if the database account has excessive privileges or database-specific execution features are available
General mitigation guidance
Mitigation generally focuses on eliminating the interpretation of request data as SQL syntax and reducing the privileges available to the application database account.
Common defensive patterns include:
- Use parameterized queries or prepared statements for every user-controlled value
- Apply strict type validation and allowlists for values such as years and process identifiers
- Avoid constructing SQL through string concatenation or interpolation
- Enforce consistent validation at service and data-access boundaries
- Use database accounts with only the permissions required by the workflow functions
- Return generic database errors and avoid exposing query details to clients
How teams detect issues like this
Organizations can look for SQL injection risks through:
- Static analysis rules identifying string concatenation or interpolation in SQL construction
- Code review checks for request parameters passed directly into query builders or repository methods
- Tests that verify parameter binding for both
yearandprocessInstanceIdpaths - Runtime monitoring for anomalous query errors, unusual database reads, and unexpected query patterns
- Policy enforcement requiring prepared statements and approved data-access abstractions
- Neutral automated security review tools that flag unparameterized database interactions
