MariaDB UpdateXML Injection

Context

This guide explores the exploitation technique of using the UpdateXML function within MariaDB for SQL injection attacks. This method is particularly effective in generating errors that can leak sensitive database information. An understanding of XML parsing, XPath queries, and SQL error handling is assumed.

Theory

Understanding UpdateXML Function in MariaDB

The UpdateXML function is a powerful tool in MariaDB used to modify XML data within the database. Its primary purpose is to update values in an XML document stored in a database. However, attackers can exploit this function by causing intentional errors to extract information from the database.

The core principle of this technique is to exploit the errors generated by the XML parser when it encounters incorrect input. These errors can reveal crucial data such as database names, user names, and version numbers.

XML Parser Abuse in SQL Injection

This technique involves manipulating the UpdateXML function to trigger XML parsing errors that leak data. The vulnerability model hinges on injecting malformed XML, which, when processed by the database, causes an error. The error messages are not properly sanitized, leading to sensitive information being displayed to the attacker.

The attack sequence typically involves crafting specific SQL queries that insert malformed XML into the UpdateXML function, thereby initiating an error that reveals internal database information.

XPath Error Exploitation

Leveraging XPath errors is a central strategy in this approach. XPath is a syntax for defining parts of an XML document. Improper implementation and handling of XPath within MariaDB can be exploited to extract sensitive information inadvertently.

The XPath error is a protocol weakness that allows attackers to gain insight into the database structure or retrieve data incorrectly exposed during the error handling process. This results from flaws in how MariaDB processes XML and XPath queries, particularly when unexpected input is encountered.

Practice

Exploiting UpdateXML for Data Extraction

To exploit the UpdateXML function for data extraction, follow these steps:

• Determine Current Database Name:

  SELECT UpdateXML(NULL, CONCAT(0x3a, (SELECT database())), NULL);
  

  This command triggers an error that reveals the name of the current database through the error message generated.

• Identify Current Database User:

  SELECT UpdateXML(NULL, CONCAT(0x3a, (SELECT user())), NULL);
  

  By executing this SQL command, you can uncover the username of the database user associated with the connection.

• Fetch MariaDB Version Information:

  SELECT UpdateXML(NULL, CONCAT(0x3a, (SELECT version())), NULL);
  

  This query intentionally causes an error that displays the version of the MariaDB server through the error output.

These exploitation steps result in accessing sensitive database information that would typically not be available to an unauthorized user. Each step introduces a crafted query that exploits the error handling flaws in the UpdateXML function.

Tools

• sqlmap
• Burp Suite

These tools can facilitate and automate the process of detecting and exploiting SQL injection vulnerabilities, including UpdateXML-based injections. They are essential for security professionals looking to efficiently identify and exploit such vulnerabilities in a testing environment.