Our developers left a surprise in handling user login. Namely:
// java
List users = hibernate.find("from Users where username = '"+formUsername+"'";
if (users.length==0) { return BAD_USER; }
if (!checkPassword(users.get(0).getPassword(), formPassword)) {
return BAD_USERNAME_PASSWORD_COMBO;
}
// continue to mark session as authenticated
Now, obviously, it's possible to inject into the query. But that is HQL language. If it was SQL, and I knew the structure of the database, I could hang a "union" operation, and could log in into any account. But I don't quite see what kind of malicious HQL I can hang on here, to really make something bad happen.
Yes, we've already replaced this code to use parameters, but I'm just curious as to what can be done in that situation. The HQL examples I've seen are about adding 'OR' operator, which will not help in this case.
Also, the underlying database is postgres, so any postgres functions are fair game.
P.S.
There was a question as to how the union would help. Given the table structure of (id,username,password), and SQL query of:
select id, username, password from users where username = ...
I can inject:
' union select 1, 'root', 'synthetic_password
and the complete executed SQL will become:
select id, username, password from users where username = '' union select 1, 'root', 'synthetic_password'
First select would not return any records, and the second will return a record that JAVA code will read and populate its beans from it. It will then compare the password, but since I provided the password data in both the injected SQL, and in the form, they will check out.
