Docker crashed when using SQLi on sqlite_master table.

[thefishermanhacker]

Hi,

Docker is crashing once I tried to test SQLi on the login page with sqlite_master table.
Scenario:

1. Start your juice-shop via a docker.
2. Go to the login page.
3. Set the following injection: ' union select name,2,3,4,null from sqlite_master--
4. Docker will be crashed.

Example of request:

POST /rest/user/login HTTP/1.1
Host: 10.15.50.45:3000
........
........
{"email":"' union select name,2,3,4,null from sqlite_master--","password":"12334445"}

If someone didn't saved the state of that docker all his/her challenges will be deleted.

Cheers.

[bkimminich]

Thanks for the report! I'll look into it. Would expect the same to happen in the local installation w/o Docker as well.

Regarding lost hacking state: When you regularly save your progress on the Score Board, you can restore your progress after a crash, as long as you didn't clear your browser cookies in between!

[thefishermanhacker]

I'm using docker and I tried this option and it didn't work as expected.
Before the crash I clicked save then I did the crash.
After the docker started no data was saved and the restore option got disabled attribute.
(No cookies were deleted and I used the save and I used the same browser and the same tab) I just clicked on refresh.

[bkimminich]

I just tried it myself and can confirm the server crash:

C:\Data\Github\juice-shop\node_modules\sqlite3\lib\trace.js:27
                    throw err;
                    ^

TypeError: Cannot read property 'dataValues' of undefined
    at Object.exports.queryResultToJson (C:\Data\Github\juice-shop\lib\utils.js:34:33)
    at Query.<anonymous> (C:\Data\Github\juice-shop\routes\login.js:40:26)
    at emitOne (events.js:96:13)
    at Query.emit (events.js:188:7)
    at Query.module.exports.CustomEventEmitter.emit (C:\Data\Github\juice-shop\node_modules\sequelize\lib\emitters\custom-event-emitter.js:61:33)
    at Query.onSuccess (C:\Data\Github\juice-shop\node_modules\sequelize\lib\dialects\sqlite\query.js:181:10)
    at Statement.<anonymous> (C:\Data\Github\juice-shop\node_modules\sequelize\lib\dialects\sqlite\query.js:52:25)
--> in Database#all('SELECT * FROM Users WHERE email = \'\' union select name,2,3,4,null from sqlite_master--\' AND password = \'827ccb0eea8a706c4c34a16891f84e7b\'', [Function])
    at executeSql (C:\Data\Github\juice-shop\node_modules\sequelize\lib\dialects\sqlite\query.js:43:54)
    at Database.<anonymous> (C:\Data\Github\juice-shop\node_modules\sequelize\lib\dialects\sqlite\query.js:67:11)
    at Query.module.exports.Query.run (C:\Data\Github\juice-shop\node_modules\sequelize\lib\dialects\sqlite\query.js:34:19)
    at ConnectorManager.module.exports.ConnectorManager.query (C:\Data\Github\juice-shop\node_modules\sequelize\lib\dialects\sqlite\connector-manager.js:44:70)
    at TransactionManager.query (C:\Data\Github\juice-shop\node_modules\sequelize\lib\transaction-manager.js:52:49)
    at Sequelize.module.exports.Sequelize.query (C:\Data\Github\juice-shop\node_modules\sequelize\lib\sequelize.js:330:36)
    at C:\Data\Github\juice-shop\routes\login.js:38:22
    at Layer.handle [as handle_request] (C:\Data\Github\juice-shop\node_modules\express\lib\router\layer.js:95:5)
    at next (C:\Data\Github\juice-shop\node_modules\express\lib\router\route.js:137:13)

[thefishermanhacker]

Added some documents I found, I assume you already read about it, but its better to have it in that bug as well.
trace.js:27

[bkimminich]

Fixed. I suppose this doesn't require a hotfix release? Would be released with the next regular v2.27.0 which is coming soon anyway.

[thefishermanhacker]

Thanks, I think you can put it on the regular release.
BTW, Do you want me to open new bug about restore challenges? I think once the docker crashed the cookies clear with it.

[bkimminich]

Yes, please do, because that requires some investigation... the cookie should have nothing to do with Docker, actually: It's just saved for that hostname in your browser. As long as you restart the Docker container on the same hostname, it should just recognize the cookie again.

[lock]

This thread has been automatically locked because it has not had recent activity after it was closed. 🔒 Please open a new issue for regressions or related bugs.