Lateral Injection Attack in Oracle
David Litchfield has discovered a way to exploit what is generally considered safe data type (DATE) which he calls lateral injection. It's a clever exploit but it can be blocked with reasonable precautions.
The exploit is described in a recent paper by Litchfield. By manipulating NLS_DATE_FORMAT, which requires ALTER SESSION privilege, an attacker can inject non-date strings into a variable of type DATE. That with a little dynamically evaluated code and the attack is under way.
Minimizing privileges, dynamically generated code and auditing what we used to consider safe code. Litchfield concludes the paper with:
The lesson here is always, always validate and don't let this type of vulnerability get into your code. The second lesson is that no longer should DATE or NUMBER data types be considered as safe and not useful as injection vectors: as this paper has proved, they are.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
