Spring Data JPA's Sort validation can be bypassed when parameters containing crafted payload are accepted from untrusted sources.

The application is vulnerable if all of the following are true:

• The application accepts Sort parameters from untrusted input and uses them without prior sanitization as input for native SQL repository methods.
• The repository method is annotated with @NativeQuery or @Query(nativeQuery=true).
• The repository method allows sorting via a Sort or Pageable parameter.
• The underlying database accepts non ASCII characters as part of its SQL syntax.

On affected databases inference of data characteristics through deterministic sorting is possible.