Re: Lateral SQL Injection Revisited - No Special Privs Required

[a.polyakov@dsec.ru]

Great work David! as usual )

I just can add a little info

Not only sysdate function can be used in procedure without input parametres.

For example using dbms_random.value in procedure without input parameters, we also can inject sql code.

---------------------------

vunerable procedure:

create or replace procedure sh2kerr_num_proc is
stmt varchar2(2000);
n number:=dbms_random.value;
begin
stmt:='select object_name from all_objects where object_id = ' || n;
execute immediate stmt;
end;
/




--------------
TEST:


SQL> ALTER SESSION SET NLS_NUMERIC_CHARACTERS = '''.' ;
Session altered.

SQL> select dbms_random.value from dual;
VALUE
----------
'763871688
SQL> exec sh2kerr_num_proc
BEGIN sh2kerr_num_proc; END;

*
ERROR at line 1:
ORA-01756: quoted string not properly terminated
--------------------------


Thats all.Thanks.




Polyakov Alexandr
Information Security Analyst
Chief researcher of DSECRG department
______________________
DIGITAL SECURITY
phone: +7 812 703 1547
+7 812 430 9130
e-mail: a.polyakov@dsec.ru
www.dsec.ru


-----------------------------------
This message and any attachment are confidential and may be privileged or otherwise protected
from disclosure. If you are not the intended recipient any use, distribution, copying or disclosure
is strictly prohibited. If you have received this message in error, please notify the sender immediately
either by telephone or by e-mail and delete this message and any attachment from your system. Correspondence
via e-mail is for information purposes only. Digital Security neither makes nor accepts legally binding
statements by e-mail unless otherwise agreed.
-----------------------------------

[David Litchfield]

Hi Alexandr,

> Not only sysdate function can be used in
> procedure without input parametres.
> For example using dbms_random.value in
> procedure without input parameters, we also can
> inject sql code.

> SQL> ALTER SESSION SET NLS_NUMERIC_CHARACTERS = '''.' ;

Thanks for pointing out dbms_random.value - I did cover
NLS_NUMERIC_CHARACTERS in the initial paper but beyond getting the query to
barf I've not yet worked out a decent/standard way of exploitation as we can
only inject 1 character. We can use this for a cursor snarfing attack
though...
Any further thoughts?
Cheers,
David

--
E-MAIL DISCLAIMER

The information contained in this email and any subsequent
correspondence is private, is solely for the intended recipient(s) and
may contain confidential or privileged information. For those other than
the intended recipient(s), any disclosure, copying, distribution, or any
other action taken, or omitted to be taken, in reliance on such
information is prohibited and may be unlawful. If you are not the
intended recipient and have received this message in error, please
inform the sender and delete this mail and any attachments.

The views expressed in this email do not necessarily reflect NGS policy.
NGS accepts no liability or responsibility for any onward transmission
or use of emails and attachments having left the NGS domain.

NGS and NGSSoftware are trading names of Next Generation Security
Software Ltd. Registered office address: 52 Throwley Way, Sutton, SM1
4BF with Company Number 04225835 and VAT Number 783096402