Hi,
I have configured monitoring Windows Event Logs, I do log message description (%m).
However, my NetXMS server started throwing events SYS_DB_QUERY_FAILED [52]
Example of Event Message:
Database query failed (Query: INSERT INTO alarm_events (alarm_id,event_id,event_code,event_name,severity,source_object_id,event_timestamp,message) VALUES (?,?,?,?,?,?,?,?); Error: [Microsoft][SQL Server Native Client 10.0][SQL Server]Violation of PRIMARY KEY constraint 'PK__alarm_ev__E6249E6BFEDA1E4D'. Cannot insert duplicate key in object 'dbo.alarm_events'. The duplicate key value is (1704, 64513).)
AlarmText: Database query failed (Query: INSERT INTO alarm_events (alarm_id,event_id,event_code,event_name,severity,source_object_id,event_timestamp,message) VALUES (?,?,?,?,?,?,?,?); Error: [Microsoft][SQL Server Native Client 10.0][SQL Server]Violation of PRIMARY KEY constraint 'PK__alarm_ev__E6249E6BFEDA1E4D'. Cannot insert duplicate key in object 'dbo.alarm_events'. The duplicate key value is (1704, 64513).) Custom message:
UserTag:
I believe that is due to my initial error message which has ' sign. So this is SQL injection to NetXMS alarm_events table.
So this is a huge bug and big security risk for all NetXMS users.
I belive this should be fixed ASAP.
Also, please correct me if I am wrong...
No, it's not due to apostrophe character and SQL injection is not possible here. You can see that SQL statement is a prepared statement with placeholders - it is not constructed dynamically from external data. Also, error message clearly states "Violation of PRIMARY KEY constraint 'PK__alarm_ev__E6249E6BFEDA1E4D'. Cannot insert duplicate key in object 'dbo.alarm_events'. The duplicate key value is (1704, 64513)" - actual problem is that system for some reason tries to insert duplicate record into table. It is definitely a bug, but not a security threat.
Best regards,
Victor
Quote from: Victor Kirhenshtein on May 08, 2014, 04:47:16 PM
No, it's not due to apostrophe character and SQL injection is not possible here. You can see that SQL statement is a prepared statement with placeholders - it is not constructed dynamically from external data. Also, error message clearly states "Violation of PRIMARY KEY constraint 'PK__alarm_ev__E6249E6BFEDA1E4D'. Cannot insert duplicate key in object 'dbo.alarm_events'. The duplicate key value is (1704, 64513)" - actual problem is that system for some reason tries to insert duplicate record into table. It is definitely a bug, but not a security threat.
Best regards,
Victor
Thank you for fast and correct response.
Now I understand this is NOT SQL injection / security hole.
Sometimes I also have: "String or binary data would be truncated", but there is lot of duplicate items.
Something maybe about wrong collecting windows event logs on a agent/client maybe or event processing rules :/
I do have latest available stable version.