VULN-004 — LINQ Injection via Unsanitised Sort Parameters

Evidence:

// api/Crt.Data/Repositories/Base/CrpRepositoryBase.cs, line 169

var pagedList = list.DynamicOrderBy($"{orderBy} {direction}") as IQueryable<TInput>;


// api/Crt.Data/IQueryableDynamicExtensions.cs

return source.OrderBy(ordering, args);   // System.Linq.Dynamic.Core — executes ordering string

Description: The orderBy and direction HTTP query parameters are interpolated into a System.Linq.Dynamic.Core expression string without any allowlist check. Dynamic LINQ can execute arbitrary expressions including method calls and property access not intended to be exposed. Every paginated endpoint is affected.

Impact: An authenticated attacker can craft orderBy values to access unexpected entity properties, disclose schema information, or trigger errors that reveal internal data structures.

Recommendation: Validate orderBy and direction against per-entity allowlists before calling DynamicOrderBy. Reject or default-replace any value not on the allowlist.

Start with api/Crt.Data/Repositories/Base/CrpRepositoryBase.cs at line 169 and follow DynamicOrderBy into api/Crt.Data/IQueryableDynamicExtensions.cs. Trace how the HTTP orderBy and direction values reach System.Linq.Dynamic.Core, then identify existing tests or request entry points for sorting. Done means arbitrary ordering expressions are no longer accepted while supported sorting still works.

Written by the indexing model from the issue text.