Skip to content
DevMeme
5160 of 7590
Little Bobby Tables applies for a TLS certificate, chaos ensues
Security Post #5648 · source on Telegram

Little Bobby Tables applies for a TLS certificate, chaos ensues

Description

Screenshot of a Windows “Certificate Information” dialog. Top left shows the yellow-triangle-over-certificate icon. A bold heading reads “Certificate Information”. Below, in plain text, it says “Windows does not have enough information to verify this certificate.” The lower half lists fields: “Issued to:” followed by the payload “',1,1,1,1,1,1,1,1,1);ATTACH DATABASE'REPOSI~1\a.php'AS a;CREATE/*”. Next line is “Issued by:” with “*/TABLE a.b(c text);INSERT INTO a.b VALUES("<?= '$_GET[c]' ?>");”. Finally, “Valid from 8/6/2022 to 8/6/2023”. Visually it looks like a legit certificate window, but the issuer and subject are pure SQL/PHP injection strings, hinting at catastrophic input-sanitisation failures. For seasoned engineers, it’s a mash-up of broken PKI trust chains, unsanitised user input, and the perennial security vs. usability battle - basically every pentester’s fever dream rendered as a cert

Categories

Security Bugs

Common Tags

SecurityFlaws SecurityVulnerabilities SQLInjectionPrevention CertificateAuthority SecurityVsUsability TrustIssuesInTech

Comments

19
Anonymous ★ Top Pick Proof that if you let the same intern handle both PKI enrollment and input sanitisation, your chain of trust ends with DROP TABLE certificates;
  1. Anonymous ★ Top Pick

    Proof that if you let the same intern handle both PKI enrollment and input sanitisation, your chain of trust ends with DROP TABLE certificates;

  2. Anonymous

    When you've been debugging certificate chain validation for three days straight and realize the real vulnerability was trusting user input in the first place - because apparently even X.509 certificates aren't safe from Bobby Tables' descendants

  3. Anonymous

    When your certificate authority's input validation is so lax that attackers can literally ATTACH DATABASE in the CN field and Windows just shrugs with 'not enough information to verify' - as if the SQL injection payload wasn't information enough. This is what happens when your PKI infrastructure treats certificate fields as free-form text and your parsing logic has never heard of parameterized queries. The real kicker? Someone actually got this certificate issued and valid for a full year, proving that certificate transparency logs are the security industry's most entertaining bug bounty program

  4. Anonymous

    When even cert issuers skip prepared statements, your CN becomes a DROP TABLE waiting to happen

  5. Anonymous

    When the CN can ATTACH DATABASE and the issuer name executes PHP, your chain of trust just became dependency injection

  6. Anonymous

    Pro tip: if the CN reaches your ORM, TLS becomes an INSERT handshake

  7. @LonelyGayTiger 2y

    I'm fascinated, I want to know how that happened.

    1. @pnlt_s 2y

      good sql escaping ¯⁠\⁠_⁠(⁠ツ⁠)⁠_⁠/⁠¯

      1. @LonelyGayTiger 2y

        Not so much. If that was the result of successful SQL injection you'd see results, not the commands themselves. It's clearly a failed attempt at SQL Injection, but it's still interesting.

        1. @pnlt_s 2y

          i literally meant that it was failed sql injection because of the query being properly escaped

          1. @LonelyGayTiger 2y

            I see. Though it's still unclear how exactly it got where it's at currently.

          2. @kitbot256 2y

            still you would expected a real CA in the "Issued by" field. I believe this is rather a future attempt to perform injection by sending this file to a system that parses certificate attributes and writes them into a database.

            1. @pnlt_s 2y

              either that or something you could make using openssl on local machine

  8. @a_sulf 2y

    its crt injection😂

  9. @pnlt_s 2y

    for memes

  10. @ZgGPuo8dZef58K6hxxGVj3Z2 2y

    Okay that's fake or RAM failure. You will never see , (comma) in entity name

    1. @ZgGPuo8dZef58K6hxxGVj3Z2 2y

      Yeah that GUI doesn't even support more then 1 line of text anyway

      1. @ZgGPuo8dZef58K6hxxGVj3Z2 2y

        That green thing is where the "label" is actually and it doesn't grow

      2. @ZgGPuo8dZef58K6hxxGVj3Z2 2y

        I could change the size with this tool too but that beside the point

More like this

More like this in Security →
Security SecurityFlaws SecurityVulnerabilities
Why Would I Ever Use a Different DSA k

Why Would I Ever Use a Different DSA k

Cryptography
Maximum CVE Density per Rack Unit

Maximum CVE Density per Rack Unit

Security
Legendary Stack Overflow Post About Incompetent Security Auditor Demanding Plaintext Passwords

Legendary Stack Overflow Post About Incompetent Security Auditor Demanding Plaintext Passwords

Security
Use J and K for navigation