Name: Multiple SQL Injection vulnerabilities in
Disk Pool Manager (DPM)
Author: Adam Zabrocki (<pi3@pi3.com.pl>)
Date: November 27, 2009 (Yes, it's very old bug ;P)
Description:
LCG Disk Pool Manager (DPM) has been developed as part of the
LCG
project to provide a light-weight implementation of an SRM compliant
Storage Element (SE). Since gLite 3.0 it is a standard gLite component,
distributed and maintained as part of the gLite release. It has been
developed at European Organization for Nuclear Research (CERN).
DPM is a disk only SE, instead of a disk + MSS implementation like
dCache or Castor. It may act as a replacement for the deprecated classic
SE with the following advantages :
- SRM interface (both v1.1 and v2.2)
- Better scalability : DPM is allow to manage 100+ TB distributing the
load over several servers
- High performances
- Light-weight management
DPM is commonly used in most of the GRID projects including CERN WLCG,
EGEE, ..., etc.
Details:
A multiple SQL Injection vulnerability has been found in Disk
Pool
Manager (DPM). Please read following details:
"./srmv2.2/srmv2_xferreq.c"
int
ns1__srmGetRequestSummary (struct soap *soap,
struct ns1__srmGetRequestSummaryRequest *req,
struct ns1__srmGetRequestSummaryResponse_ *rep)
{
...
char *r_token;
...
...
...
for (i = 0; i < nbtokens; i++) {
...
r_token = req->arrayOfRequestTokens->stringArray[i];
if (strlen (r_token) > CA_MAXDPMTOKENLEN) {
reptokenp->status->statusCode =
SRM_USCOREINVALID_USCOREREQUEST;
reptokenp->status->explanation =
soap_strdup (soap, "Invalid request token");
nb_errors++;
continue;
}
if (dpm_getonereqsummary (thip, r_token, &r_type,
&r_status,
&nbreqfiles, &nb_queued, &nb_progress, &nb_failed) <
0) {
...
...
}
...
...
}
...
...
}
This function is responsible fo reading and parsing requests. If length
of "r_token"
variable is not greather than CA_MAXDPMTOKENLEN function
dpm_getonereqsummary() is called:
"dpm/dpm_procsubr.c"
dpm_getonereqsummary (thip, r_token, r_type, r_status, nbreqfiles,
nb_queued, nb_progress, nb_failed)
struct dpm_srv_thread_info *thip;
char *r_token;
char *r_type;
int *r_status;
int *nbreqfiles;
int *nb_queued;
int *nb_progress;
int *nb_failed;
{
...
...
if (dpm_get_pending_req_by_token (&thip->dbfd, r_token,
&dpm_req, 0, NULL) < 0 &&
dpm_get_req_by_token (&thip->dbfd, r_token, &dpm_req, 0,
NULL) < 0)
return (-1);
...
...
}
... and:
"dpm/dpm_mysql_ifce.c"
dpm_get_pending_req_by_token(dbfd, r_token, dpm_req, lock, rec_addr)
struct dpm_dbfd *dbfd;
char *r_token;
struct dpm_req *dpm_req;
int lock;
dpm_dbrec_addr *rec_addr;
{
char func[29];
static char query[] =
"SELECT \
R_ORDINAL, R_TOKEN, R_UID, \
R_GID, CLIENT_DN, CLIENTHOST, \
R_TYPE, U_TOKEN, \
FLAGS, RETRYTIME, NBREQFILES, \
CTIME, STIME, ETIME, \
STATUS, ERRSTRING, GROUPS \
FROM dpm_pending_req \
WHERE r_token = '%s'";
static char query4upd[] =
"SELECT ROWID, \
R_ORDINAL, R_TOKEN, R_UID, \
R_GID, CLIENT_DN, CLIENTHOST, \
R_TYPE, U_TOKEN, \
FLAGS, RETRYTIME, NBREQFILES, \
CTIME, STIME, ETIME, \
STATUS, ERRSTRING, GROUPS \
FROM dpm_pending_req \
WHERE r_token = '%s' \
FOR UPDATE";
MYSQL_RES *res;
MYSQL_ROW row;
char sql_stmt[1024];
MYSQL_RES *res;
MYSQL_ROW row;
char sql_stmt[1024];
strcpy (func, "dpm_get_pending_req_by_token");
sprintf (sql_stmt, lock ? query4upd : query, r_token);
if (dpm_exec_query (func, dbfd, sql_stmt, &res))
return (-1);
...
...
}
This function creates a query to the MySQL Database - DPM supports three
different databases: MySQL, PostgreSQL and Oracle. In this advisory
I'm focused on MySQL database. This vulnerability may be in all
supported databases. I haven't analyzed all the code.
Variable 'r_token' isn't verified at all so SQL Injection attack is
possible. Anyone with a certificate from a recognised CA can access
the SRM interface so it is a serious vulnerability.
SQL Injection exists not only in dpm_get_pending_req_by_token()
function.
Please read following list of functions which don't check inputs too:
Function dpm_get_cpr_by_fullid() doesn't check 'r_token'
Function dpm_get_cpr_by_surl() doesn't check 'r_token', 'surl'
Function dpm_get_cpr_by_surls() doesn't check 'r_token', 'to_surl'
Function dpm_get_gfr_by_fullid() doesn't check 'r_token'
Function dpm_get_gfr_by_surl() doesn't check 'r_token'
Function dpm_get_pending_req_by_token() doesn't check 'r_token'
Function dpm_get_pending_reqs_by_u_desc() doesn't check 'u_token'
Function dpm_get_pfr_by_fullid() doesn't check 'r_token'
Function dpm_get_pfr_by_surl() doesn't check 'r_token'
Function dpm_get_pool_entry() doesn't check 'poolname' variable but
admin required so it isn't important.
Function dpm_get_req_by_token() doesn't check 'r_token'
Function dpm_get_reqs_by_u_desc() doesn't check 'u_token'
Function dpm_get_spcmd_by_token() doesn't check 's_token'
Function dpm_get_spcmd_by_u_desc() doesn't check 'u_token'
Function dpm_insert_cpr_entry() doesn't check variable 's_token',
'r_token'.
Function dpm_insert_fs_entry() doesn't check 'poolname' variable but
admin required so it isn't important.
Function dpm_insert_gfr_entry() doesn't check variable 's_token',
'r_token'.
Function dpm_insert_pending_entry() doesn't check variable 'u_token',
'r_token'.
Function dpm_insert_pfr_entry() doesn't check variable 's_token',
'r_token'.
Function dpm_insert_pool_entry() doesn't check 'poolname' variable but
admin required so it isn't important.
Function dpm_insert_spcmd_entry() doesn't check variable 's_token',
'u_token' and (not important)
'poolname' - admin required.
Functino dpm_insert_xferreq_entry() doesn't check variable 'u_token',
'r_token'.
Function dpm_list_cpr_entry() doesn't check 'r_token'
Functino dpm_list_fs_entry() doesn't check 'poolname' variable but
admin required so it isn't important.
Function dpm_list_gfr_entry() doesn't check 'r_token'
Function dpm_list_pfr_entry() doesn't check 'r_token'
Function dpm_update_cpr_entry() doesn't check 's_token'
Function dpm_update_gfr_entry() doesn't check 's_token'
Function dpm_update_pfr_entry() doesn't check 's_token'
Function dpm_update_spcmd_entry() doesn't check 'poolname' variable but
admin required so it isn't important.
Proof of concept
$ ./srm2_testGetRequestStatus srm://vmgdda0013.cern.ch:8446/ \'
request status SRM_FAILURE
request state 1
explanation: Failed for all tokens
request summaryArray 1
======= Begin Request ========
Request token: '
state[0]: 14 SRM_INTERNAL_ERROR
$
Please read following dump of SRM log file:
07/23 18:01:50.330 9720,0 dpm_get_pending_req_by_token: mysql_query
error: You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
near ''''' at line 1
07/23 18:01:50.330 9720,0 dpm_get_req_by_token: mysql_query error: You
have an error in your SQL syntax; check the manual that corresponds to
your MySQL server version for the right syntax to use near ''''' at line
1
07/23 18:01:50.330 9720,0 GetRequestSummary: returns 0,
statusCode=SRM_FAILURE
Here is strace output from the SRMv2.2 process:
poll([{fd=7, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
write(7, "\335\0\0\0\3SELECT \t\t R_ORDINAL, R_TOKEN, R_UID, \t\t R_GID,
CLIENT_DN, CLIENTHOST, \t\t R_TYPE, U_TOKEN, \t\t FLAGS, RETRYTIME,
NBREQFILES, \t\t CTIME, STIME, ETIME, \t\t STATUS, ERRSTRING, GROUPS
\t\tFROM dpm_pending_req \t\tWHERE r_token = '''", 225) = 225
read(7, "\236\0\0\1\377(\4#42000You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the
right syntax to use near ''''' at line 1", 16384) = 162
gettimeofday({1311434508, 295920}, NULL) = 0
open("/var/log/srmv2.2/log", O_WRONLY|O_CREAT|O_APPEND, 0664) = 8
write(8, "07/23 17:21:48.295 9720,0 dpm_get_pending_req_by_token:
mysql_query error: You have an error in your SQL syntax; check the
manual that corresponds to your MySQL server version for the right
syntax to use near ''''' at line 1\n", 226) = 226
close(8) = 0
poll([{fd=7, events=POLLIN|POLLPRI}], 1, 0) = 0 (Timeout)
write(7, "\325\0\0\0\3SELECT \t\t R_ORDINAL, R_TOKEN, R_UID, \t\t R_GID,
CLIENT_DN, CLIENTHOST, \t\t R_TYPE, U_TOKEN, \t\t FLAGS, RETRYTIME,
NBREQFILES, \t\t CTIME, STIME, ETIME, \t\t STATUS, ERRSTRING, GROUPS
\t\tFROM dpm_req \t\tWHERE r_token = '''", 217) = 217
read(7, "\236\0\0\1\377(\4#42000You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the
right syntax to use near ''''' at line 1", 16384) = 162
gettimeofday({1311434508, 296597}, NULL) = 0
open("/var/log/srmv2.2/log", O_WRONLY|O_CREAT|O_APPEND, 0664) = 8
write(8, "07/23 17:21:48.296 9720,0 dpm_get_req_by_token: mysql_query
error: You have an error in your SQL syntax; check the manual that
corresponds to your MySQL server version for the right syntax to use
nea r ''''' at line 1\n", 218) = 218
close(8) = 0
gettimeofday({1311434508, 296942}, NULL) = 0
open("/var/log/srmv2.2/log", O_WRONLY|O_CREAT|O_APPEND, 0664) = 8
write(8, "07/23 17:21:48.296 9720,0 GetRequestSummary: returns 0,
statusCode=SRM_FAILURE\n", 80) = 80
close(8) = 0
And here is strace from the MySQL process:
read(31, "\3SELECT \t\t R_ORDINAL, R_TOKEN, R_UID, \t\t R_GID, CLIENT_DN
, CLIENTHOST, \t\t R_TYPE, U_TOKEN, \t\t FLAGS, RETRYTIME, NBREQFILES,
\t\t CTIME, STIME, ETIME, \t\t STATUS, ERRSTRING, GROUPS \t\tFROM
dpm_pending_req \t\tWHERE r_token = '''", 221) = 221
rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [HUP INT QUIT PIPE ALRM TERM
TSTP], 8) = 0
rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP], NULL, 8)
= 0
fcntl(31, F_SETFL, O_RDWR|O_NONBLOCK) = 0
time([1311436910]) = 1311436910
sched_setscheduler(15280, SCHED_OTHER, { 6 }) = -1 EINVAL (Invalid
argument)
sched_setscheduler(15280, SCHED_OTHER, { 8 }) = -1 EINVAL (Invalid
argument)
write(31, "\236\0\0\1\377(\4#42000You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the
right syntax to use near ''''' at line 1", 162) = 162
time([1311436910]) = 1311436910
read(31, 0x1f7ae9b0, 4) = -1 EAGAIN (Resource
temporarily unavailable)
time(NULL) = 1311436910
rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [HUP INT QUIT PIPE ALRM TERM
TSTP], 8) = 0
rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP], NULL, 8)
= 0
fcntl(31, F_SETFL, O_RDWR) = 0
read(31, "\325\0\0\0", 4) = 4
read(31, "\3SELECT \t\t R_ORDINAL, R_TOKEN, R_UID, \t\t R_GID, CLIENT_DN
, CLIENTHOST, \t\t R_TYPE, U_TOKEN, \t\t FLAGS, RETRYTIME, NBREQFILES,
\t\t CTIME, STIME, ETIME, \t\t STATUS, ERRSTRING, GROUPS \t\tFROM
dpm_req \t\tWHERE r_token = '''", 213) = 213
rt_sigprocmask(SIG_BLOCK, ~[RTMIN RT_1], [HUP INT QUIT PIPE ALRM TERM
TSTP], 8) = 0
rt_sigprocmask(SIG_SETMASK, [HUP INT QUIT PIPE ALRM TERM TSTP], NULL, 8)
= 0
fcntl(31, F_SETFL, O_RDWR|O_NONBLOCK) = 0
time([1311436910]) = 1311436910
sched_setscheduler(15280, SCHED_OTHER, { 6 }) = -1 EINVAL (Invalid
argument)
sched_setscheduler(15280, SCHED_OTHER, { 8 }) = -1 EINVAL (Invalid
argument)
write(31, "\236\0\0\1\377(\4#42000You have an error in your SQL syntax;
check the manual that corresponds to your MySQL server version for the
right syntax to use near ''''' at line 1", 162) = 162
time([1311436910]) = 1311436910
read(31, 0x1f7ae9b0, 4) = -1 EAGAIN (Resource
temporarily unavailable)
Affected Software:
All versions of Disk Pool Manager (DPM) below 1.8.6 version are
affected.
1.8.6 was released 19th of February 2013.
Greets
+) David Smith - for testing infrastructures and other helps not only
at this topic.
References
1) https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2012-2683
2) http://site.pi3.com.pl/adv/disk_pool_manager_1.txt
3) http://blog.pi3.com.pl/?p=402
Timeline
2009-11-27 - Found vulnerability.
2011-08-03 - Vulnerability officialy reported.
2013-02-19 - Updated packages available in the EGI UMD-1 and EGI UMD-2.
2013-03-05 - Public disclosure on vendor's wiki, after allowing sites to
upgrade
(https://wiki.egi.eu/wiki/SVG:Advisory-SVG-2012-2683)
2013-03-10 - Release of this advisory.
Best regards,
Adam Zabrocki
--
http://pi3.com.pl
