SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level

[poincaredisk]

>Topic

SQL injection isn't dead, because I stumble upon a sql injection vulnerability every other day as a part of my job.

[cqqxo4zV46cp]

Django got hit with an SQL injection vulnerability just the other day. I basically fell out of my chair when I saw it.

[plugger]

Can confirm. My last good finding was a unauthed and blind SQLi.

[29athrowaway]

I do not like the term SQL injection nowadays. I think it must be generalized to query injection. It makes people believe that NoSQL somehow is exempt from such problems.

[colimbarna]

I agree, I also dislike the term SQL injection. But the problem isn't that there is a query, there problem is that the source code of one program is constructed by string manipulation in the source code of another program. XSS issues (where javascript can be embedded into a string that is supposed to be a value in a HTML document) are the same. Also occurs with shell scripts. The goal has to be to avoid such manual processes. Between lower level languages, it's customary to export a function call in a standard ABI. It should also be the same here: regard queries as function calls in a foreign language. Javascript is basically there, but query languages only have fits and starts (e.g. you often have some syntax like `SELECT * FROM "tbl" where "field" = ?` which can then accept the parameter in a form that is intended for transferring user values) and generally rely on good hygiene and ORMs to protect the end user.

[simonw]

The full slides for the presentation (PDF) are here: https://media.defcon.org/DEF%20CON%2032/DEF%20CON%2032%20pre...

Anyone know if DEF CON publish videos of this kind of session?

[Sohcahtoa82]

Yes, they'll publish them on their YouTube channel, usually a couple weeks after the convention.

https://www.youtube.com/@DEFCONConference

[mmetzger]

They do eventually, but it usually takes at least a couple months if not more.

[seeknotfind]

Well this is a buffer overflow attack, not injection, but hey, it's in a SQL program!

Though SQL injection and other injection attacks are definitely not dead. All it takes is one programmer mistake and poof! Lots of XSS rely on accidentally injection of some value. Also hey lots of LLM based attacks are injection. Injection is not dead... oh no oh no

[fulafel]

No, it's a desync by integer overflow, there's no overflowing buffer. Due to the incorrect length field, the db server starts parsing the next db protocol message from the middle of attacker-supplied data which gives the attacker control of db commands.

(A case could be made for calling it a buffer underflow maybe?)

[avery17]

I always thought the internet would get more sophisticated and secure as time went on and my days of SQL injection were limited to my teenage years but it seems as the internet becomes more accessible the number of armature developers putting insecure websites up in rising raidly.

[yencabulator]

It's request smuggling, not a buffer overflow.

[Ekaros]

Also I get the feeling lot of instruction on topic like SQL Injection is just incorrect or not even best practise anymore. And it keeps being parroted. Like recommending input sanitization. It can be part of solution and probably should consider what to accept on any input. But it is not full or even efficient solution, specially when often it is implemented incorrectly or imperfectly...

So it is complex field and there is always more vectors like this.

[TedDallas]

I’m seriously thinking about getting a custom made bumper sticker with the following text: ‘; select 1/0;

[fragmede]

https://hackaday.com/wp-content/uploads/2014/04/18mpenleoksq...

[boltzmann_]

Very smart!

[CodeWriter23]

> The current way to protect against these attacks is to ensure a size limit on incoming requests. This can be more difficult than you may expect - Paul points out that alternative paths such as WebSockets might bypass limits that are in place for regular HTTP requests, plus some servers may apply limits before decompression, allowing an attacker to send a compressed payload that is larger than the configured limit.

Interesting...a security researcher that thinks it's ok to trust the client.

[root_axis]

He's saying the opposite.

His point is that adding in a request limit in your server config may not be enough because protocols like websocket might not inherit those size restrictions automatically due to specialized logic for implementing sockets over http.

[Stefan-H]

What part of that do you interpret as trusting the client?

[cma]

He says it's more difficult than you might expect not to.