4

I have the Logging and Alerts module installed on a few of my sites. Yesterday I noticed a series of notification emails with the following data. These produced PDOException exceptions and so far as I can tell were unsuccessful at doing anything malicious.

This site was patched hours after SA-CORE-2014-005 was announced on 2014-Oct-15.

I simply want verification that these types of SQL injection attacks create PDOExceptions in Drupal, vs stripping the offending key/values from the injection attempt. Prior to the patch I wasn't receiving any such errors.

Email Title from LoggingAlerts module:
[] Error: PDOException: SQLSTATE[42000]: Syntax error or access...

Email Message Body:
admin@site.com  Mon, Nov 17, 2014 at 11:04 AM
To: admin@site.com
Site: https://site.com
Severity: Error (3)
Timestamp: 2014­11­17 11:04:35
Type: php
IP Address: 128.xxx.xxx.xxx
Request URI: https://site.com/?q=user/login
Referrer URI:
User: Anonymous (0)
Link:
Message:
PDOException: SQLSTATE[42000]: Syntax error or access violation: 1064 You
have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near ' 'test' AND status =
1' at line 1: SELECT * FROM {users} WHERE name = :name_0, :name_1 AND status
= 1; Array
(
[:name_0] => test3
[:name_1] => test
)
in user_login_authenticate_validate() (line 2149 of
/var/www/mysite/htdocs/modules/user/user.module).
$_SERVER => Array
(
[HTTP_HOST] => site.com
[HTTP_X_REAL_IP] => 198.101.235.xxx
[HTTP_X_FORWARDED_FOR] =>

... lots of more lines of email output ...
1

It is my understanding that in theory, yes, a compromised site from the particular vulnerability could lead to such behaviour. As Drupal.org recommends, in such cases you should treat your site as compromised and all next actions should be the appropriate for this case.

The fact that you patched the site shortly after the announcement, as you mentioned, is very important. As far as I have seen, most attacks are coming from scripts and it has not come to my attention any automated attack that would cause such behaviour (to my experience of course). This again is not reassuring, just a thought on the possibility for the nasty thing to have happened.

Apart from the obvious actions (see links below), I would definititely take a good look of the code that doesn't behave nicely. Also a good tool is always diff comparing to clean code. I would as well take a good look in the db. Last, there might also be a possibility that some contributed module has got issues with 7.32 or maybe anything else that might have been updated.

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

https://www.drupal.org/drupalsa05FAQ

  • I believe you're wrong, see my answer below after much much searching. – tenken Nov 25 '14 at 18:23
  • Can you please let me know which part of my answer is wrong and why? It seems to me that your answer agrees with it, with more detail why. – Wtower Nov 26 '14 at 8:16
  • I dont believe my site is compromised. Drupal 7.32 and highe produces a pdoexception on all sql injection attempts – tenken Nov 26 '14 at 9:45
  • I never said it is. – Wtower Nov 26 '14 at 10:23
1

As per this answer -- Drupal throws a PDOException on sql injection attempts as of Drupal 7.32: https://drupal.stackexchange.com/a/133820/3279

From the testing module:

/**
+   * Test SQL injection via database query array arguments.
+   */
+  public function testArrayArgumentsSQLInjection() {
+    // Attempt SQL injection and verify that it does not work.
+    $condition = array(
+      "1 ;INSERT INTO {test} SET name = 'test12345678'; -- " => '',
+      '1' => '',
+    );
+    try {
+      db_query("SELECT * FROM {test} WHERE name = :name", array(':name' => $condition))->fetchObject();
+      $this->fail('SQL injection attempt via array arguments should result in a PDOException.');
+    }
+    catch (PDOException $e) {
+      $this->pass('SQL injection attempt via array arguments should result in a PDOException.');
+    }
+
+    // Test that the insert query that was used in the SQL injection attempt did
+    // not result in a row being inserted in the database.
+    $result = db_select('test')
+      ->condition('name', 'test12345678')
+      ->countQuery()
+      ->execute()
+      ->fetchField();
+    $this->assertFalse($result, 'SQL injection attempt did not result in a row being inserted in the database table.');
+  }
+
  • Thank you. I've been worrying about this same issue since updating. I also see two errors accompanying the PDO exception "Warning: addcslashes() expects parameter 1 to be string, array given in" and "Warning: mb_strlen() expects parameter 1 to be string, array given"... Hope that future versions of Drupal fix this; user input, especially anonymous, should be diligently cleaned and not even reach the database for checks before the cleanups. – Mario Awad Nov 26 '14 at 15:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.