DEF CON 32 - SQL Injection Isn't Dead Smuggling Queries at the Protocol Level - Paul Gerste

SQL injections seem to be a solved problem; databases even have built-in support for prepared statements, leaving no room for injections. In this session, we will go a level deeper: instead of attacking the query syntax, we will explore smuggling attacks against database wire protocols, through which remote, unauthenticated attackers can inject entire (No)SQL statements into an application's database connection.

Using vulnerable database driver libraries as case studies, we will bring the concept of HTTP request smuggling to binary protocols. By corrupting the boundaries between protocol messages, we desynchronize an application and its database, allowing the insertion of malicious messages that lead to authentication bypasses, data leakage, and remote code execution.

To put our findings into context, we will explore the real-world applicability of this new concept by comparing how robust various languages and frameworks are against these attacks. We will also discuss how smuggling attacks are not specific to database wire protocols but affect all kinds of binary protocols, from databases over message queues to caching. We will end the session with inspirations for future research to explore the topic further.

[devongreene]

Excellent presentation Paul! The TLV charts and sequencing diagrams were perfect. I also really liked the mentality of crafting payloads like you would simple stack overflows w/ NOPs or trampolines (exploitation really is art). Paul really opened a lot of eyes with this talk about how you can still achieve SQL Injection in the most impossible of scenarios. Well done 👏👏👏

[davidel]

Awesome talk and great visuals, thank you for spending the time and making the slides so beautiful!

[recklessroges]

25:16 I got some deja vu - I felt like that BSON attack had been presented before, at some conference. (We probably meta a searchable meta db that can help cross-reference all tech conference talks.)

[berndeckenfels]

Asn1 seems to be a candidate in the past for such overflows.

[logiciananimal]

Given that Azure actually exposes Postgres DBMSes to the internet ... I wonder this can be used to attack these. People claim these are ok since there is access control at the DB layer, but ...

I wonder if anyone is still using PHP.

[werawerlnwerlnrlnelr]

Sounds interesting but I stopped watching at "home of clean code", clean code is a bad cult