Select Code_execution from * Using SQLite; (2019)

Re:Select Code_execution from * Using SQLite; (2019) by bob1029 on Saturday June 13, 2020 @02:25PM (#23511478)

I don't see the practical attack vector. For every use case I have for SQLite, none of them involve allowing someone to execute arbitrary SQL against one of my databases. We also don't do any loading of databases from untrusted parties. Seems like a hypothetical scenario was invented here that could just as well be applied to any database engine with similar outcomes.

[ Parent | on HN ]

Re:Select Code_execution from * Using SQLite; (2019) by cortesoft on Saturday June 13, 2020 @03:08PM (#23511837)

This is related to the other top post on HN right now about using SQLite as your application file format, which would conceivably involve sending saved files to others.

[ Parent | on HN ]

Re:Select Code_execution from * Using SQLite; (2019) by ysleepy on Saturday June 13, 2020 @02:32PM (#23511536)

The exploit works with any query performed on the sqlite db file.

The expected tables are replaced by views that execute the arbitrary sql.

[ Parent | on HN ]

Re:Select Code_execution from * Using SQLite; (2019) by SQLite on Saturday June 13, 2020 @03:18PM (#23511910)

The attack is clever and original. AFAIK, nothing like it has ever been seen before.

Since this attack came to light, SQLite has added features so that an application can ensure that views and triggers do not have side-effects (outside of the database file itself). And if there are no side-effects then the attack is basically harmless. Sure, the attacker can still exfiltrate or corrupt data, but the attacker had to have write access to the database file in order to carry out the attack in the first place, so exfiltrating or corrupting data is not an issue - they could already do that. See a quick summary at https://sqlite.org/forum/forumpost/8beceed68e

[ Parent | on HN ]

Re:Select Code_execution from * Using SQLite; (2019) by Drip33 on Saturday June 13, 2020 @03:23PM (#23511938)

Was the write a shell php file portion of the video/exploit patched?

Sites like https://sqliteonline.com/ and https://inloop.github.io/sqlite-viewer/ could be perpetually vulnerable if not?

[ Parent | on HN ]

Re:Select Code_execution from * Using SQLite; (2019) by dsabanin on Saturday June 13, 2020 @02:42PM (#23511624)

If you watch the actual presentation, you will see clear attack vectors, exploited right there for you.

[ Parent | on HN ]

Re:Select Code_execution from * Using SQLite; (2019) by devwastaken on Saturday June 13, 2020 @03:24PM (#23511951)

Watched it, but all I'm seeing is queries that require arbitrary access in the first place. If you're using sqlite with prepared statements via another programming language, I'm failing to see how these attacks can be used.

Most of these attacks rely on creation of virtual table. Can that be done using a simple select statement with prepared statements?

[ Parent | on HN ]

Re:Select Code_execution from * Using SQLite; (2019) by zorked on Saturday June 13, 2020 @02:28PM (#23511493)

There are a few applications that use SQL databases as their save file format.

[ Parent | on HN ]