After Drupal 7.32 should sql injection attempts create PDOExceptions?

Question

I have the Logging and Alerts module installed on a few of my sites. Yesterday I noticed a series of notification emails with the following data. These produced PDOException exceptions and so far as I can tell were unsuccessful at doing anything malicious.

This site was patched hours after SA-CORE-2014-005 was announced on 2014-Oct-15.

I simply want verification that these types of SQL injection attacks create PDOExceptions in Drupal, vs stripping the offending key/values from the injection attempt. Prior to the patch I wasn't receiving any such errors.

Email Title from LoggingAlerts module:
[] Error: PDOException: SQLSTATE[42000]: Syntax error or access...

Email Message Body:
[email protected]  Mon, Nov 17, 2014 at 11:04 AM
To: [email protected]
Site: https://site.com
Severity: Error (3)
Timestamp: 2014­11­17 11:04:35
Type: php
IP Address: 128.xxx.xxx.xxx
Request URI: https://site.com/?q=user/login
Referrer URI:
User: Anonymous (0)
Link:
Message:
PDOException: SQLSTATE[42000]: Syntax error or access violation: 1064 You
have an error in your SQL syntax; check the manual that corresponds to your
MySQL server version for the right syntax to use near ' 'test' AND status =
1' at line 1: SELECT * FROM {users} WHERE name = :name_0, :name_1 AND status
= 1; Array
(
[:name_0] => test3
[:name_1] => test
)
in user_login_authenticate_validate() (line 2149 of
/var/www/mysite/htdocs/modules/user/user.module).
$_SERVER => Array
(
[HTTP_HOST] => site.com
[HTTP_X_REAL_IP] => 198.101.235.xxx
[HTTP_X_FORWARDED_FOR] =>

... lots of more lines of email output ...

Answer 1

It is my understanding that in theory, yes, a compromised site from the particular vulnerability could lead to such behaviour. As Drupal.org recommends, in such cases you should treat your site as compromised and all next actions should be the appropriate for this case.

The fact that you patched the site shortly after the announcement, as you mentioned, is very important. As far as I have seen, most attacks are coming from scripts and it has not come to my attention any automated attack that would cause such behaviour (to my experience of course). This again is not reassuring, just a thought on the possibility for the nasty thing to have happened.

Apart from the obvious actions (see links below), I would definititely take a good look of the code that doesn't behave nicely. Also a good tool is always diff comparing to clean code. I would as well take a good look in the db. Last, there might also be a possibility that some contributed module has got issues with 7.32 or maybe anything else that might have been updated.

Drupal SA-CORE-2014-005 - How to tell if my server / sites were compromised?

https://www.drupal.org/drupalsa05FAQ

Answer 2

As per this answer -- Drupal throws a PDOException on sql injection attempts as of Drupal 7.32: https://drupal.stackexchange.com/a/133820/3279

From the testing module:

/**
+   * Test SQL injection via database query array arguments.
+   */
+  public function testArrayArgumentsSQLInjection() {
+    // Attempt SQL injection and verify that it does not work.
+    $condition = array(
+      "1 ;INSERT INTO {test} SET name = 'test12345678'; -- " => '',
+      '1' => '',
+    );
+    try {
+      db_query("SELECT * FROM {test} WHERE name = :name", array(':name' => $condition))->fetchObject();
+      $this->fail('SQL injection attempt via array arguments should result in a PDOException.');
+    }
+    catch (PDOException $e) {
+      $this->pass('SQL injection attempt via array arguments should result in a PDOException.');
+    }
+
+    // Test that the insert query that was used in the SQL injection attempt did
+    // not result in a row being inserted in the database.
+    $result = db_select('test')
+      ->condition('name', 'test12345678')
+      ->countQuery()
+      ->execute()
+      ->fetchField();
+    $this->assertFalse($result, 'SQL injection attempt did not result in a row being inserted in the database table.');
+  }
+