🥇 A new exploitation technique for vulnerabilities in SQLite has been presented

Researchers from Check Point revealed at the DEF CON conference provided details on a new attack technique targeting applications that utilize vulnerable versions of SQLite. The Check Point method treats database files as a means for integrating exploitation scripts into various internal SQLite subsystems that are not accessible for direct exploitation. The researchers also developed a technique for exploiting vulnerabilities by encoding the exploit as a chain of SELECT queries in the SQLite database, which allows bypassing ASLR.

For a successful attack, it is necessary to have the ability to modify the database files of the targeted applications, which limits the method to attacks on applications that use SQLite databases for transit and input data. The method can also be used to extend already obtained local access, for instance, to integrate hidden backdoors into the applications in use, as well as to evade security mechanisms during malware analysis. Exploitation after the file replacement occurs at the moment the application executes the first SELECT query to the table in the modified database.

As an example, the possibility of code execution in iOS was demonstrated when opening a contacts app whose database file 'AddressBook.sqlitedb' had been modified using the proposed method. The attack exploited a vulnerability in the fts3_tokenizer function (CVE-2019-8602, pointer dereferencing), which was fixed in the April update of SQLite 2.28, alongside another vulnerability in the implementation of window functions. Furthermore, the method was demonstrated for remotely capturing control over a PHP backend server used by attackers to gather passwords intercepted during the operation of malware (the intercepted passwords were transmitted in the form of an SQLite database).

The attack method is based on the use of two techniques: 'Query Hijacking' and 'Query Oriented Programming,' which allow the exploitation of arbitrary issues leading to memory corruption in the SQLite engine. The essence of 'Query Hijacking' is the substitution of the contents of the 'sql' field in the system table sqlite_master, which defines the structure of the database. This field contains a block of DDL (Data Definition Language) used to describe the structure of objects in the database. The description is provided using standard SQL syntax, i.e., the 'CREATE TABLE' construct is used.
that is executed during the database initialization process (at the first launch of the function sqlite3LocateTable) to create internal structures linked to the table in memory.
The idea is that by replacing 'CREATE TABLE' with 'CREATE VIEW', it becomes possible to control any access to the database through the definition of one’s view. By using 'CREATE VIEW', the 'SELECT' operation is bound to the table, which will be invoked instead of 'CREATE TABLE' and allows access to various parts of the SQLite interpreter. The simplest way to attack further would be to call the 'load_extension' function, which allows loading any arbitrary library with an extension, but this function is disabled by default.

To conduct the attack under conditions allowing the 'SELECT' operation, a technique known as 'Query Oriented Programming' has been proposed, which enables exploitation of issues in SQLite that lead to memory corruption. This technique resembles Return-Oriented Programming (

ROP, Return-Oriented Programming), but uses nonexistent snippets of machine code to build a chain of calls ('gadgets') instead of actual machine code fragments, embedding them in subqueries within SELECT.Researchers from Check Point revealed details of a new attack technique at the DEF CON conference.