SQL Injection Attacks and Defense - 2009

326 Chapter 7 • Advanced Topics
Notes from the Underground…
Other Truncation Attacks
Truncation of user-supplied input in SQL queries can lead to vulnerabilities even
when pure SQL injection is not possible. In Microsoft SQL Server, parameterized queries
must specify a maximum length for each string parameter, and if longer input is
assigned to the parameter it is truncated to this length. Furthermore, SQL Server
ignores trailing whitespace when comparing strings within a WHERE clause. These
features can lead to a range of problems in vulnerable applications. For example,
suppose an application allows users who have forgotten their password to submit their
e-mail address and receive their forgotten password via e-mail. If the application
accepts overly long input which gets truncated within the SQL query, an attacker can
submit the following input:
victim@example.org [many spaces]; evil@attacker.org
In the resultant query, this input will retrieve the password for victim@example.
org, because the trailing whitespace in the truncated input is ignored:
SELECT password FROM tblUsers WHERE email = 'victim@example.org'
When the application then sends the password to the originally supplied e-mail
address, a copy is also sent to the attacker, enabling him to compromise the victim’s
account. For further details of this and similar attacks, see the paper “Buffer Truncation
Abuse in .NET and Microsoft SQL Server,” written by Gary O’Leary-Steele and available
at www.scoobygang.org/HiDDenWarez/bta.pdf.
Bypassing Custom Filters
Web applications are extremely varied, and you are likely to encounter all kinds of weird and
wonderful input filters in the wild. You frequently can bypass these filters with a little
imagination.
Oracle Application Server provides a useful case study in poorly devised custom filters.
This product provides a Web interface to database procedures, enabling developers to
quickly deploy a Web application based on functionality that is already implemented