MySQL command-line client HTML injection vulnerability

[Thomas Henlich]

MYSQL COMMAND-LINE CLIENT HTML INJECTION VULNERABILITY

Thomas Henlich <thomas@henlich.de>

DESCRIPTION

The mysql command-line client does not quote HTML special characters
like < in its output. This allows an attacker who is able to write data
into a table to hide or modify records in the output, and to inject
potentially dangerous code, e. g. Javascript to perform cross-site
scripting or cross-site request forgery attacks.

HOW TO REPRODUCE

$ mysql --html --execute "select '<a>'" ...
<TABLE BORDER=1><TR><TH><a></TH></TR><TR><TD><a></TD></TR></TABLE>

AFFECTED VERSIONS

All.

RESOLUTION

Users are advised to install the available patch from
http://bugs.mysql.com/bug.php?id=27884.

WORKAROUND

If another resolution is not feasible, users are advised to modify their
SELECT statements to filter out the characters < and &:

SELECT REPLACE(REPLACE(...,'&','&amp;'),'<','&lt;') AS ...;

This workaround is incompatible with the described resolution and should
be reversed after installation of the patch.

TIMELINE

2007-04-17 Opened bug on mysql.com
2008-05-01 Patch available

RESOURCES

The bug is filed on http://bugs.mysql.com/bug.php?id=27884.

This advisory is available from
http://www.henlich.de/it-security/mysql-command-line-client-html-injection-vulnerability.

[Quark IT - Hilton Travis]

Hi Thomas,

This bug was fixed in a MySQL release dated 01 May 2008. It is now 01
Oct 2008 - 5 months after the bug was released. So why exactly is this
news? Did I miss something here?

--

http://blog.hiltontravis.com/

Regards,

Hilton Travis Phone: +61 (0)7 3105 9101
(Brisbane, Australia) Phone: +61 (0)419 792 394
Manager, Quark IT http://www.quarkit.com.au
Quark Group http://www.quarkgroup.com.au

Microsoft SBSC PAL (Australia) http://www.sbscpal.com/

War doesn't determine who is right. War determines who is left.

This document and any attachments are for the intended recipient
only. It may contain confidential, privileged or copyright
material which must not be disclosed or distributed.

Quark Group Pty. Ltd.
T/A Quark Automation, Quark AudioVisual, Quark IT

> -----Original Message-----
> From: Thomas Henlich [mailto:thomas@henlich.de]
> Sent: Tuesday, 30 September 2008 6:30 PM
> To: bugtraq@securityfocus.com
> Subject: MySQL command-line client HTML injection vulnerability
>
> MYSQL COMMAND-LINE CLIENT HTML INJECTION VULNERABILITY
>
> Thomas Henlich <thomas@henlich.de>
>
> DESCRIPTION
>
> The mysql command-line client does not quote HTML special characters
> like < in its output. This allows an attacker who is able to write
data
> into a table to hide or modify records in the output, and to inject
> potentially dangerous code, e. g. Javascript to perform cross-site
> scripting or cross-site request forgery attacks.
>
> HOW TO REPRODUCE
>
> $ mysql --html --execute "select '<a>'" ...
> <TABLE BORDER=1><TR><TH><a></TH></TR><TR><TD><a></TD></TR></TABLE>
>
> AFFECTED VERSIONS
>
> All.
>
> RESOLUTION
>
> Users are advised to install the available patch from
> http://bugs.mysql.com/bug.php?id=27884.
>
> WORKAROUND
>
> If another resolution is not feasible, users are advised to modify
> their
> SELECT statements to filter out the characters < and &:
>
> SELECT REPLACE(REPLACE(...,'&','&amp;'),'<','&lt;') AS ...;
>
> This workaround is incompatible with the described resolution and
> should
> be reversed after installation of the patch.
>
> TIMELINE
>
> 2007-04-17 Opened bug on mysql.com
> 2008-05-01 Patch available
>
> RESOURCES
>
> The bug is filed on http://bugs.mysql.com/bug.php?id=27884.
>
> This advisory is available from
> http://www.henlich.de/it-security/mysql-command-line-client-html-
> injection-vulnerability.

[Michael Scheidell]

> Hi Thomas,
>
> This bug was fixed in a MySQL release dated 01 May 2008. It is now 01
> Oct 2008 - 5 months after the bug was released. So why exactly is this
> news? Did I miss something here?


Not fixed in any version I know of.
Patch has been available for 5 months, but this has not gotten into any
production version (or am I wrong?)
Try this on your system:

mysql --html --execute "select '<a>'"

If you get this, then its not patched:
<TABLE BORDER=1><TR><TH><a></TH></TR><TR><TD><a></TD></TR></TABLE>

If you get this (on 5.1, a little different than 5.0) than its patched:
(note the escaped <a>)
--
Michael Scheidell, CTO
>|SECNAP Network Security
Winner 2008 Network Products Guide Hot Companies
FreeBSD SpamAssassin Ports maintainer



<TABLE
BORDER=1><TR><TH>&lt;a&gt;</TH></TR><TR><TD>&lt;a&gt;</TD></TR></TABLE>


__________________________________________________ _______________________
This email has been scanned and certified safe by SpammerTrap(r).
For Information please see http://www.spammertrap.com
__________________________________________________ _______________________