fix(security): resolve SQL injection protection bypass (942380 PL2) #3720

azurit · 2024-05-27T11:50:58Z

I found TONS of ways how to bypass rule 942380 and some of them were extremely easy (for example using \s instead of \s+ in regex).

We are now able to catch these new ways of injection:

HAVING 2-1
HAVING 1 mod 2
HAVING 1 div 1
HAVING true = 1
HAVING false = 0
HAVING 1++++1
HAVING ''=''
HAVING '1'=1
HAVING ('1'=2)
HAVING 1%1
HAVING 1&1
HAVING 1*1
HAVING 1/1
HAVING 1|1
HAVING 1^2
HAVING 1!=2
HAVING 1<>1

Also, we are now catching these:

CREATE TABLE`test`
EXECUTE`test`

We are still NOT catching these:

HAVING 1
HAVING true

fzipi

In your bypass example you mention for example using \s instead of \s+ in regex.

What is the difference on what you did? Does having work with no spacing?

regex-assembly/942380.ra

azurit · 2024-09-04T05:28:27Z

In your bypass example you mention for example using \s instead of \s+ in regex.

What is the difference on what you did? Does having work with no spacing?

\s means exactly 1 space so it can be bypassed using 2 or more spaces. Any SQL server ignores excessive spaces in commands. For example order\sby can be bypassed using order by.

theseion · 2024-09-05T05:31:45Z

You could try removing all spaces with a transformation first.

regex-assembly/942380.ra

github-actions · 2024-12-25T08:29:25Z

📊 Quantitative test results for language: eng, year: 2023, size: 10K, paranoia level: 1:
🚀 Quantitative testing did not detect new false positives

azurit · 2025-05-06T07:28:07Z

Ready to review again.

theseion · 2025-05-10T06:45:58Z

regex-assembly/942380.ra

+\bhaving\s*\(?\s*(?:['"]?\s*\d+\s*['"]?|['"]\s*[^\d]*\s*['"]|true|false)\s*(?:[=<>+\-*/%^&!|]+|div|mod)
+\bexecute\s*\(
+\bexecute\b\s*`?\s*[\w\.$]+\s*`?
+\bcreate\b\s+\btable\b\s*`?\s*.+?\s*`?\s*\(


The \bs are redundant since \s+ implies non-word characters between the two strings.

Suggested change

\bcreate\b\s+\btable\b\s*`?\s*.+?\s*`?\s*\(

\bcreate\s+table\b\s*`?\s*.+?\s*`?\s*\(

theseion · 2025-05-10T06:52:17Z

regex-assembly/942380.ra

+\bhaving\s*\(?\s*(?:['"]?\s*\d+\s*['"]?|['"]\s*[^\d]*\s*['"]|true|false)\s*(?:[=<>+\-*/%^&!|]+|div|mod)
+\bexecute\s*\(
+\bexecute\b\s*`?\s*[\w\.$]+\s*`?
+\bcreate\b\s+\btable\b\s*`?\s*.+?\s*`?\s*\(


Too complicated. Break it up into alternations, e.g.:

Suggested change

\bcreate\b\s+\btable\b\s*`?\s*.+?\s*`?\s*\(

\bcreate\b\s+\btable\b[^(]+\(

\bcreate\b\s+\btable\b\s*`\s*[^\s`]+\s*`\s*\(

@theseion But it's not the same. Your version will match also this:
create table
Mine is matching, at least, this:
create table (

I don't think this one can be splitted into parts.

How do my proposed expressions match create table? Both require \(. ? can always be written as an alternation (|), in this case

...(?:`|)...

And [^\(]+ is just a simplification of the wildcards in the original expression. So yes, I'm pretty sure that's correct :).

@theseion Hm, if i understand it correctly, you replaced this line:
\bcreate\b\s+\btable\b\s*`?\s*.+?\s*`?\s*\(

with these two?

\bcreate\b\s+\btable\b[^(]+\( \bcreate\b\s+\btable\b\s*`\s*[^\s`]+\s*`\s*\(

Yes. The first doesn't have the backtick enclosed part, the second always has backticks. The result would be (spaces added for readability):

\bcreate\b\s+\btable\b[^(]+\( | \bcreate\b\s+\btable\b\s*`\s*[^\s`]+\s*`\s*\(

Shortened:

\bcreate\b\s+\btable\b(?:[^(]+\( | \s*`\s*[^\s`]+\s*`\s*\()

theseion · 2025-05-10T06:52:34Z

regex-assembly/942380.ra

-\bhaving\b ?\d{1,10} ?[=<>]+
-\bhaving\b ?[\'\"][^=]{1,10}[\'\" ?[=<>]+
-\bcreate\s+?table.{0,20}?\(
+\bhaving\s*\(?\s*(?:['"]?\s*\d+\s*['"]?|['"]\s*[^\d]*\s*['"]|true|false)\s*(?:[=<>+\-*/%^&!|]+|div|mod)


Too complicated. Break it up.

theseion · 2025-05-10T06:53:46Z

regex-assembly/942380.ra

-exists\s\bhaving\b\s+\d{1,10}
-exists\s'[^=]{1,10}'
-\bexists\s*?\(\s*?select\b
+\bselect\b.*?\bcase\b


Suggested change

\bselect\b.*?\bcase\b

\bselect\b.+?\bcase\b

theseion · 2025-05-10T06:54:05Z

regex-assembly/942380.ra

-\bexists\s*?\(\s*?select\b
+\bselect\b.*?\bcase\b
+\bfrom\b.*?\blimit\b
+\bfrom\b.*?\bgroup\b\s+\bby\b


Suggested change

\bfrom\b.*?\bgroup\b\s+\bby\b

\bfrom\b.+?\bgroup\b\s+\bby\b

tests/regression/tests/REQUEST-942-APPLICATION-ATTACK-SQLI/942380.yaml

Xhoenix · 2025-08-28T08:53:06Z

regex-assembly/942380.ra

-\bhaving\b ?\d{1,10} ?[=<>]+
-\bhaving\b ?[\'\"][^=]{1,10}[\'\" ?[=<>]+
-\bcreate\s+?table.{0,20}?\(
+\bhaving\s*\(?\s*(?:['"]?\s*\d+\s*['"]?|['"]\s*[^\d]*\s*['"]|true|false)\s*(?:[=<>+\-*/%^&!|]+|div|mod)


Suggested change

\bhaving\s*\(?\s*(?:['"]?\s*\d+\s*['"]?|['"]\s*[^\d]*\s*['"]|true|false)\s*(?:[=<>+\-*/%^&!|]+|div|mod)

\bhaving\s+\(?\s*(?:['"]?\s*\d+\s*['"]?|['"]\s*[^\d]*\s*['"]|true|false)\s*(?:[=<>+\-*/%^&!|]+|div|mod)

I think * is correct here. The parser might accept ...having'..., for example.

The msg is SQL Injection Attack, atleast MySQL expects a space after HAVING, haven't checked others. Maybe @azurit has more info about this.

I don't think it matters really in terms of the regex. As long as we assume that it can happen we should be fine either way.

azurit added 4 commits May 27, 2024 13:47

Fixing bypasses of rule 942380

04088f4

Fixing tests

e794a91

Fixing regex

0782aaa

Adding one more test

9616eb4

azurit requested a review from franbuehler May 27, 2024 12:08

dune73 mentioned this pull request Jun 3, 2024

Monthly Chat Agenda June 2024 (2024‐06‐03 and 2024‐06‐17) #3728

Closed

github-actions bot added the Stale label Jun 28, 2024

fzipi mentioned this pull request Jul 1, 2024

Monthly Chat Agenda July 2024 (2024‐07‐01 and 2024‐07‐15) #3728 #3753

Closed

github-actions bot closed this Jul 12, 2024

azurit reopened this Jul 15, 2024

azurit removed the Stale label Jul 15, 2024

github-actions bot added the Stale label Aug 15, 2024

github-actions bot closed this Aug 29, 2024

azurit reopened this Aug 29, 2024

azurit removed the Stale label Aug 29, 2024

fzipi mentioned this pull request Sep 2, 2024

Monthly Chat Agenda September 2024 (2024-09-02 and 2024-09-16) #3808

Closed

fzipi self-requested a review September 2, 2024 18:54

fzipi reviewed Sep 3, 2024

View reviewed changes

regex-assembly/942380.ra Outdated Show resolved Hide resolved

Xhoenix reviewed Sep 19, 2024

View reviewed changes

regex-assembly/942380.ra Outdated Show resolved Hide resolved

azurit added 5 commits September 20, 2024 11:21

Update 942380.yaml

45f71f5

Update 942380.yaml

b088b9f

Update 942380.yaml

e134e3b

Merge branch 'main' into Bypass942380

f352070

Update 942380.yaml

989e61a

Xhoenix mentioned this pull request Oct 3, 2024

fix(942120): update operators #3841

Merged

fzipi mentioned this pull request Oct 7, 2024

Monthly Chat Agenda October 2024 (2024-10-07 and 2024-10-21) #3848

Closed

github-actions bot added the Stale label Oct 21, 2024

azurit removed the Stale label Nov 2, 2024

theseion reopened this Dec 25, 2024

theseion removed the Stale label Dec 25, 2024

fzipi mentioned this pull request Jan 6, 2025

Monthly Chat Agenda January 2025 (2025-01-06) #3975

Closed

github-actions bot added the Stale label Jan 25, 2025

Xhoenix removed the Stale label Feb 3, 2025

fzipi mentioned this pull request Feb 2, 2025

Monthly Chat Agenda February 2025 (2025-02-03) #3990

Closed

fzipi mentioned this pull request Mar 3, 2025

Monthly Chat Agenda March 2025 (2025-03-03) #4033

Closed

github-actions bot added the Stale label Mar 6, 2025

Xhoenix removed the Stale label Mar 7, 2025

github-actions bot added the Stale label Apr 7, 2025

Xhoenix removed the Stale label Apr 7, 2025

fzipi mentioned this pull request Apr 7, 2025

Monthly Chat Agenda April 2025-04-07 #4087

Closed

Xhoenix added the release:fix label Apr 9, 2025

fzipi mentioned this pull request May 5, 2025

Monthly Chat Agenda May 2025-05-05 #4116

Closed

azurit added 2 commits May 6, 2025 09:18

Merge branch 'main' into Bypass942380

45d0e41

Update 942380.yaml

9812fc0

theseion requested changes May 10, 2025

View reviewed changes

fzipi mentioned this pull request Jun 2, 2025

Monthly Chat Agenda June 2025-06-02 #4153

Closed

github-actions bot added the Stale label Jun 10, 2025

Xhoenix removed the Stale label Jun 13, 2025

fzipi mentioned this pull request Jul 7, 2025

Monthly Chat Agenda July 2025 (2025-07-07) #4184

Closed

azurit added 2 commits July 13, 2025 18:21

Update 942380.yaml

a8e55ac

Merge branch 'main' into Bypass942380

d42c436

fzipi mentioned this pull request Aug 4, 2025

Monthly Chat Agenda August 2025 (2025-08-04) #4223

Closed

github-actions bot added the Stale label Aug 16, 2025

Xhoenix removed the Stale label Aug 28, 2025

Xhoenix reviewed Aug 28, 2025

View reviewed changes

fzipi mentioned this pull request Sep 1, 2025

Monthly Chat Agenda September (2025-09-01) #4252

Open

	\bcreate\b\s+\btable\b\s`?\s.+?\s`?\s\(
	\bcreate\s+table\b\s`?\s.+?\s`?\s\(

	\bcreate\b\s+\btable\b\s`?\s.+?\s`?\s\(
	\bcreate\b\s+\btable\b[^(]+\(
	\bcreate\b\s+\btable\b\s`\s[^\s`]+\s`\s\(

	\bhaving\s\(?\s(?:['"]?\s\d+\s['"]?\|['"]\s[^\d]\s['"]\|true\|false)\s(?:[=<>+\-*/%^&!\|]+\|div\|mod)
	\bhaving\s+\(?\s(?:['"]?\s\d+\s['"]?\|['"]\s[^\d]\s['"]\|true\|false)\s(?:[=<>+\-/%^&!\|]+\|div\|mod)

Uh oh!

fix(security): resolve SQL injection protection bypass (942380 PL2) #3720

Are you sure you want to change the base?

fix(security): resolve SQL injection protection bypass (942380 PL2) #3720

Uh oh!

Conversation

azurit commented May 27, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

fzipi left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

azurit commented Sep 4, 2024

Uh oh!

theseion commented Sep 5, 2024

Uh oh!

Uh oh!

github-actions bot commented Dec 25, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

azurit commented May 6, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

azurit commented May 27, 2024 •

edited

Loading

github-actions bot commented Dec 25, 2024 •

edited

Loading