A Race to the Bottom - Database Transactions Undermining Your AppSec

No ratings

Presented at No Hat 2024 by

Viktor Chuchurski

In the context of relational databases such as Postgres, MySQL/MariaDB or MSSQL, a transaction is a construct used to wrap complex business operations, ensuring the application is safe from data corruption. But what happens when they start working against you? This presentation will show a darker side of database transactions: as a potential source of application vulnerabilities. Learn how common patterns of (mis)use can introduce data races and easily exploitable race conditions. We'll dig into database internals and find out how the helpful hand of the database engine introduces the vulnerability, ways of exploiting it and look at possible mitigations.