{JS-ON: Security-OFF}: Abusing JSON-Based SQL Queries
No ratings
Presented at BlackHat Europe 2022 by
All major SQL-based database engines such as Postgres, SQLite, MS SQL, and MySQL have in the last few years started to adopt native JSON features that enable data interactions with complicated JSON-type objects. While these native JSON features are enabled by default, developers and researchers may still not be aware of the risk they introduce. We decided to find out, and whether they can be hacked.We've learned that the introduction of native JSON has opened a new, fertile ground for security researchers that could enable attackers to generically bypass web application firewalls (WAF), exploit object-relational mappings (ORM), and even break prepared statements. You'll see how we did so by abusing native JSON syntax in SQL. In this presentation, we'll introduce you to the world of JSON in SQL, including its new operators (what the heck is "?&" or "#>>" ?), syntax, and new SQL injection payloads (the new ' or 1=1).We will showcase vulnerabilities and common pitfalls in popular applications, libraries, and ORMs by abusing these new SQL features. Doing so allowed us to achieve a generic WAF bypass that affects all major WAF players, including Amazon AWS, Palo-Alto, CloudFlare, F5 and others. We will also share a Git repository containing the results of this research, newly created JSON SQL injection payloads, and a tool for exploiting this new attack technique.