{"id":17650,"date":"2021-11-02T12:23:50","date_gmt":"2021-11-02T06:53:50","guid":{"rendered":"https:\/\/www.varutra.com\/?p=17650"},"modified":"2022-12-02T11:42:44","modified_gmt":"2022-12-02T06:12:44","slug":"hibernate-query-language-hql-injection","status":"publish","type":"post","link":"https:\/\/www.varutra.com\/varutravrt3\/hibernate-query-language-hql-injection\/","title":{"rendered":"Hibernate Query Language (HQL) Injection"},"content":{"rendered":"


\nHQL is the abbreviation for\u00a0Hibernate Query Language<\/strong>. Hibernate can be classified as ORM or Object-Relational Mapping. It maps class definitions with similar SQL tables that are present within the source code. It is an object-oriented query language that is similar to SQL. However, it works with persistent objects and their properties instead of operating on tables and columns. Hibernate translates HQL queries into conventional SQL queries that act on the database.<\/p>\n

\"Hibernate<\/p>\n

Figure 1: Hibernate query language<\/strong><\/p>\n

 <\/p>\n

ORM (Object Relational Mapping)<\/strong><\/h3>\n

Object-Relational Mapping (ORM) is a well-known programming technique that helps to convert data between object-oriented programming languages (e.g., C#, Java, etc.) and relational databases. RDBMS represents the data in tabular format, but OOPS follows the concept of objects, and it represents data as a connected graph of objects.<\/p>\n

\"Object-relational<\/p>\n

Figure 2: Object-relational mapping<\/strong><\/p>\n

SQL database management systems (DBMS) can only store as they are not object-oriented. They can even manipulate scalar values like integers and strings, which are organized within tables. Therefore, object values must be converted into groups of more exact figures for storage in the database (and convert them back upon retrieval), or only use simple scalar values within the program.<\/p>\n

\"Object-relational<\/p>\n

Figure 3: Object-relational mapping<\/strong><\/p>\n

 <\/p>\n

Hibernate<\/strong><\/h3>\n

Hibernate is an Object-Relational Mapping solution that is used for JAVA. It maps Java classes to database tables and Java data types to SQL data types, giving you retrieval facilities and data queries.<\/p>\n

Whenever we write a query, it does not directly go to the database. It is first going to hibernate engine that parses the query and interprets it, later it gets converted to SQL. Any error message we get during testing can come from either hibernate engine or database.<\/p>\n

 <\/p>\n

SQL Injection versus ORM \/ Hibernate Query Language injection<\/strong><\/h3>\n

HQL has some restrictions over SQL injection, for example – No union, no function to create easy delay, no system function, no metadata tables available, etc.<\/p>\n

\"SQL<\/p>\n

Figure 4: SQL vs. HQL<\/strong><\/p>\n

 <\/p>\n

Approach and Methodology For Hibernate Query Language injection<\/strong><\/h3>\n

HQL injection is an attack that uses SQL Injection. This attack is carried out against an ORM-generated data access object model. It is an attack identical to a SQL Injection<\/a>, but the injection vulnerability exists in code generated by the ORM layer.<\/p>\n

If an injection is present in HQL syntax, it cannot be exploited as a standard SQL injection. It happens because the HQL language has its syntax, which is more restricted (for example, there is no way to query unmapped tables). If you are getting \u201corg.hibernate.QueryException\u201d after inserting some special characters in any application parameter, then it is possible that HQL Injection is already present.<\/p>\n

\"HQL<\/p>\n

Figure 5: HQL error<\/strong><\/p>\n

As proceeding further, we need to break the syntax and form our payloads to exploit it further. Different RDBMS uses different escaping techniques. For example \u2013 MySQL Database escape character \u2018with \\*. Please note HQL does not support UNION queries. Also, the malicious input will always be between the percentage symbols.<\/p>\n

 <\/p>\n

Example:<\/strong><\/h3>\n

HQL List Columns<\/strong><\/p>\n

from Student<\/p>\n

where name like ‘%’<\/p>\n

and DOESNT_EXIST=1 and ”=’%’ —<\/p>\n

and register= true<\/p>\n

HQL Error Based<\/strong><\/p>\n

from Student<\/p>\n

where firstName like ‘%11′<\/p>\n

and (select password from User where username=’admin’)=1<\/p>\n

or ”=’%’<\/p>\n

and register = true<\/p>\n

 <\/p>\n

Conclusion<\/strong><\/h3>\n

In this post, you get to know that an additional layer of security is not provided in Hibernate. As a result, hackers can easily break through the HQL language to compromise data. It is possible because the old tricks are still fully functional to break out through the HQL language.<\/p>\n

 <\/p>\n

Reference:<\/strong><\/h3>\n

https:\/\/en.wikipedia.org\/wiki\/Object%E2%80%93relational_mapping<\/a><\/p>\n

https:\/\/conference.hitb.org\/hitbsecconf2016ams\/materials\/D2T2%20-%20Mikhail%20Egorov%20and%20Sergey%20Soldatov%20-%20New%20Methods%20for%20Exploiting%20ORM%20Injections%20in%20Java%20Applications.pdf<\/a><\/p>\n

https:\/\/github.com\/swisskyrepo\/PayloadsAllTheThings\/blob\/master\/SQL%20Injection\/HQL%20Injection.md<\/p>\n

https:\/\/www.fullstackpython.com\/object-relational-mappers-orms.html<\/a><\/p>\n

https:\/\/www.tutorialspoint.com\/hibernate\/hibernate_query_language.htm<\/a><\/p>\n

http:\/\/interviewquestionjava.blogspot.com\/2014\/01\/framework-orm-object-relational-mapping.html<\/a><\/p>\n

https:\/\/blog.h3xstream.com\/2014\/02\/hql-for-pentesters.html<\/p>\n

 <\/p>\n

Author,<\/p>\n

Prashasti Rikhari<\/strong><\/p>\n

Attack & PenTest Team<\/p>\n

Varutra Consulting Pvt. Ltd<\/p>","protected":false},"excerpt":{"rendered":"

HQL is the abbreviation for\u00a0Hibernate Query Language. Hibernate can be classified as ORM or Object-Relational Mapping. It maps class definitions with similar SQL tables that…<\/p>\n","protected":false},"author":4,"featured_media":17660,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"om_disable_all_campaigns":false,"inline_featured_image":false,"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"footnotes":""},"categories":[272],"tags":[546,548,547,424],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t