https://simonwillison.net/2024/Aug/12/smuggling-queries-at-the-protocol-level/

Simon Willison's Weblog

Subscribe

SQL Injection Isn't Dead: Smuggling Queries at the Protocol Level (
via) PDF slides from a presentation by Paul Gerste at DEF CON 32. It
turns out some databases have vulnerabilities in their binary
protocols that can be exploited by carefully crafted SQL queries.

Paul demonstrates an attack against PostgreSQL (which works in some
but not all of the PostgreSQL client libraries) which uses a message
size overflow, by embedding a string longer than 4GB (2**32 bytes)
which overflows the maximum length of a string in the underlying
protocol and writes data to the subsequent value. He then shows a
similar attack against MongoDB.

The current way to protect against these attacks is to ensure a size
limit on incoming requests. This can be more difficult than you may
expect - Paul points out that alternative paths such as WebSockets
might bypass limits that are in place for regular HTTP requests, plus
some servers may apply limits before decompression, allowing an
attacker to send a compressed payload that is larger than the
configured limit.

How Web Apps Handle Large Payloads. Potential bypasses: - Unprotected
endpoints - Compression - WebSockets (highlighted) - Alternate body
types - Incrementation. Next to WebSockets: - Compression support -
Large message size - Many filters don't apply

Posted 12th August 2024 at 3:36 pm

Recent articles

  * django-http-debug, a new Django app mostly written by Claude -
    8th August 2024
  * Weeknotes: a staging environment, a Datasette alpha and a bunch
    of new LLMs - 6th August 2024
  * Datasette 1.0a14: The annotated release notes - 5th August 2024

http 93 mongodb 11 postgresql 125 security 465 sql-injection 6 
websockets 16

  * Colophon
  * (c)
  * 2002
  * 2003
  * 2004
  * 2005
  * 2006
  * 2007
  * 2008
  * 2009
  * 2010
  * 2011
  * 2012
  * 2013
  * 2014
  * 2015
  * 2016
  * 2017
  * 2018
  * 2019
  * 2020
  * 2021
  * 2022
  * 2023
  * 2024