Blind SQL injection in an HTTP header opening a path to operating system command execution
Time-based blind SQL injection in a non-standard HTTP header. The database user held administrator privileges, which opened the way to operating system command execution through stored procedures.
Summary
The header value reached the database from the application’s own log, concatenated into the query. That header crosses proxies and load balancers, so anyone could reach the entry point.
The injection allowed stacked queries, so the original query could be chained with new statements. At that privilege level, the system stored procedures were reachable.
Technical details
Injection vector
The application recorded the value of certain HTTP headers in the database:
GET /[REDACTED]/errors.aspx HTTP/2
Host: [REDACTED]
Cookie: [REDACTED]
X-Forwarded-For: [PAYLOAD]
User-Agent: Mozilla/5.0 ...Confirming the injection
We confirmed it with time-based payloads, which delayed the response when the evaluated condition was true:
X-Forwarded-For: [PREFIX]'); IF ([CONDITION]) WAITFOR DELAY '0:0:5'--
[+] 5-second delay observed -> condition TRUEElevated privileges
We verified that the application user held administrator privileges on the database:
[+] The application user has database administrator privileges
[+] Stacked queries supported
[+] Multiple databases accessible on the serverPath to command execution
With administrator privileges, we tested the stored procedures that run operating system commands:
X-Forwarded-For: [PREFIX]'); EXEC [stored_procedure] 'echo test';--
[!] Behaviour consistent with an enabled command execution procedureWe stopped exploitation at this point: the system was in production. We ran no command beyond the harmless check and extracted no real data.
We reported the finding to the client immediately, with a critical severity rating. The case is published anonymised: the client, its systems and its data are not identified.
The full CVSS breakdown, including the vector, is set out in the report delivered to the client.
Impact
- Command execution on the database server: the chain was verified up to the step before impact
- Access to the multiple databases hosted on that server
- Exfiltration of the sensitive data within reach of the compromised database account
- Lateral movement potentially available within the internal network
- Compromise of the server and potentially of the domain
Remediation
- Parameterise all SQL queries. Never concatenate HTTP header values into a query: use prepared statements.
- Reduce the privileges of the application user. The database connection should not run under an administrator account.
- Disable the command execution procedures. Keep them enabled only where a specific process requires them.
- Treat HTTP headers as untrusted input. Validate length and format before storing them, without that validation replacing the parameterised query.
- Review the WAF configuration. Its rules should cover injections in non-standard headers.
References
More write-ups
This vector, verified against your assets
Tell us which assets you want tested. We reply within 24 hours.