4 ms·
Can someone enlighten me on how easy this SQL injection vulnerability is to exploit? I thought that SQL injection was "mostly" a thing of the past with newer f
by jtchang 14y ago
Can someone enlighten me on how easy this SQL injection vulnerability is to exploit?
I thought that SQL injection was "mostly" a thing of the past with newer frameworks such as Rails and Django. I mean, short of concatenating your query string together, it is much harder to set yourself up for failure.
- sentiental 14y agoUnfortunately it's not hard to manipulate this one. AR generates a couple queries when you do a single invocation - the first is a meta data query to get info about the table you're talking to. The second (or third, etc) are the actual hard queries. It's the first query, the metadata one, that applies the passed arguments in a raw form directly to the query. The exploit takes place inside of a 'show' operation. It's totally unprotected and lets you run pretty much any select you're interested in. It also goes beyond prepared statements - the metadata query in question is totally separate from the one specified by any parameterized query you'd pass using something like ('id = ?', params[:id]). So essentially, as a developer, you can't do anything better. This is kind of on the framework side alone :/
- lansing 14y agoTake a look at the test they added in the patch for an example of how the exploit would go down.
- kmf 14y agoLooks like two tests (test_where_error_with_hash and test_where_with_table_name). You can see those tests here: http://seclists.org/oss-sec/2012/q2/att-504/3-2-sql-injection.patch http://seclists.org/oss-sec/2012/q2/att-504/3-2-sql-injectio... (this is for 3.2, you can change the patch name for 3.1, etc.)
- zhoutong 14y agoBased on this report, this is my rough understanding of this vulnerability: When you pass nested query parameters such as "id[a]=b&id[c]=d", Rails will parse it as parameters :id => {'a' => 'b', 'c' => 'd'} If you use where(:id => params[:id]) it will become where(:id => {'a' => 'b', 'c' => 'd'}) And when Rails convert that to SQL statement, something can be exploited (though it's not mentioned in the report).
- benmmurphy 14y agoas far as i can see it is a little harder to exploit because you can't access the results of the sql injection. but you can change how long it takes for the query to execute based on the value in a column so you can extract arbitrary values from the database using this technique.
- c3 14y agoIt's only a security problem if you're using the Model#where form. If you're doing Model#all or #each or whatever, you're fine.
- omgsean 14y agoAre you sure? That's what I thought at first, but was the .where form even available in versions before 3.0?