Microsoft SQL Server SQLXML Script Injection Vulnerability
BID:5005
Info
Microsoft SQL Server SQLXML Script Injection Vulnerability
| Bugtraq ID: | 5005 |
| Class: | Input Validation Error |
| CVE: |
CVE-2002-0187 |
| Remote: | Yes |
| Local: | No |
| Published: | Jun 12 2002 12:00AM |
| Updated: | Jul 11 2009 01:56PM |
| Credit: | Credited to Matt Moore of Westpoint Ltd. |
| Vulnerable: |
Microsoft SQL Server 2000 SP2 Microsoft SQL Server 2000 SP1 Microsoft SQL Server 2000 |
| Not Vulnerable: | |
Discussion
Microsoft SQL Server SQLXML Script Injection Vulnerability
SQLXML is a component of SQL Server 2000, which enables SQL servers to receive and send database queries via XML (Extensible Markup Language) format. Such queries can be sent using various methods of communication, one of which is via HTTP. SQLXML HTTP components reside in a virtual directory on a web server and are not enabled by default.
It is possible, under some circumstances, to inject arbitrary script code via XML tags. This may allow an attacker to execute script code in the context of the Internet Explorer Security Zone associated with the IIS server running the vulnerable components.
It should be noted that successful exploitation of this vulnerability is highly conditional. Firstly, the victim of the attack must have access to an IIS server running vulnerable versions of the SQLXML HTTP components. The victim of the attack must also have sufficient privileges to pass queries to the underlying SQL server. Lastly, the attacker must also have knowledge of the virtual directory that has been set up on the IIS Server for SQLXML HTTP components.
SQLXML is a component of SQL Server 2000, which enables SQL servers to receive and send database queries via XML (Extensible Markup Language) format. Such queries can be sent using various methods of communication, one of which is via HTTP. SQLXML HTTP components reside in a virtual directory on a web server and are not enabled by default.
It is possible, under some circumstances, to inject arbitrary script code via XML tags. This may allow an attacker to execute script code in the context of the Internet Explorer Security Zone associated with the IIS server running the vulnerable components.
It should be noted that successful exploitation of this vulnerability is highly conditional. Firstly, the victim of the attack must have access to an IIS server running vulnerable versions of the SQLXML HTTP components. The victim of the attack must also have sufficient privileges to pass queries to the underlying SQL server. Lastly, the attacker must also have knowledge of the virtual directory that has been set up on the IIS Server for SQLXML HTTP components.
Exploit / POC
Microsoft SQL Server SQLXML Script Injection Vulnerability
The following proof of concept was provided by Matt Moore <[email protected]>:
IIS-server/Northwind?sql=SELECT+contactname,+phone+FROM+Customers+FOR+XML&root=
<SCRIPT>alert(document.domain)</SCRIPT>
The following proof of concept was provided by Matt Moore <[email protected]>:
IIS-server/Northwind?sql=SELECT+contactname,+phone+FROM+Customers+FOR+XML&root=
<SCRIPT>alert(document.domain)</SCRIPT>
Solution / Fix
Microsoft SQL Server SQLXML Script Injection Vulnerability
Solution:
Microsoft has released the following patches which rectify this issue:
Microsoft SQL Server 2000
Microsoft SQL Server 2000 SP1
Microsoft SQL Server 2000 SP2
Solution:
Microsoft has released the following patches which rectify this issue:
Microsoft SQL Server 2000
-
Microsoft SQLXML2_Q321460
For SQL Server 2000 Client Tools installed and SQLXML Web Release 2
http://download.microsoft.com/download/SQLSVR2000/Patch/Q321460/W98NT4 2KMe/EN-US/SQLXML2_Q321460.EXE
Microsoft SQL Server 2000 SP1
-
Microsoft SQLXML2_Q321460
For SQL Server 2000 Client Tools installed and SQLXML Web Release 2
http://download.microsoft.com/download/SQLSVR2000/Patch/Q321460/W98NT4 2KMe/EN-US/SQLXML2_Q321460.EXE
Microsoft SQL Server 2000 SP2
-
Microsoft Q321858_SQL_Security_MDAC26
For SQL Server 2000 Gold MDAC26
http://download.microsoft.com/download/SQLSVR2000/SQLXML/Q321858/NT45X P/EN-US/Q321858_SQL_Security_MDAC26.exe -
Microsoft Q321858_SQL_Security_MDAC27
For SQL Server 2000 Gold MDAC27
http://download.microsoft.com/download/SQLSVR2000/SQLXML/Q321858/NT45X P/EN-US/Q321858_SQL_Security_MDAC27.exe -
Microsoft SQLXML2_Q321460
For SQL Server 2000 Client Tools installed and SQLXML Web Release 2
http://download.microsoft.com/download/SQLSVR2000/Patch/Q321460/W98NT4 2KMe/EN-US/SQLXML2_Q321460.EXE -
Microsoft SQLXML3_Q320833
For SQL Server 2000 Client Tools installed and SQLXML Web Release 3
http://download.microsoft.com/download/SQLSVR2000/Patch/Q320833/W98NT4 2KMe/EN-US/SQLXML3_Q320833.EXE
References
Microsoft SQL Server SQLXML Script Injection Vulnerability
References:
References:
- Microsoft Security Bulletin MS02-030 (Microsoft)
- Vulnerability Note VU#139931 (CERT/CC)