Why You Need to Use Rules in Your Yii2 Framework Models

In the previous article, we described the vulnerability discovered in the Yii2 Framework 2.0.35. In this piece, you’ll find out how to prevent it.  It’s a highly recommended read, especially for web developers who want to quickly check the rule settings and fix a detected vulnerability.

 

Yii is an object-oriented component framework that implements the MVC design pattern (learn more on Wiki). 

 

We used Yii2 Framework 2.0.35 as a demo configuration.How a seemingly safe Active Record call in the Yii2 framework can seriously compromise a web application?

$name=Yii::$app->request->post('name');
       $password=Yii::$app->request->post('password');
       $user = User::findOne(['name'=>$name,'password'=>$password]);
       if(!$user){
               echo "no way!";
       }else{
               echo "Hello! $user->name";
       }

We created a sample MySQL table:

mysql> select * from user;
+-------+--------------------+
| name  | password       |
+-------+--------------------+
| admin | W0o0oO0_very_St0Ng |
+-------+--------------------+

Here is what happens during the Active Record call procedure: 

 

• two POST parameters—name and password—are used to call the User model with the findOne method.

 

This exploitation technique is applicable to other Active Record methods, including those which use the POST parameters mentioned above as arguments.

Here is the description of the findOne method from Yii2 documentation:

findOne()

Returns a single active record model instance by a primary key or an array of column values.

The database query will look like:

SELECT * FROM `user` where `name` = ‘$name’ and `password`= ‘$password’

Active Record calls, when used properly, are virtually unaffected by SQL injections. 

 

Let’s test the query with the correct password:

And with an incorrect password:

Everything works as expected. So what is wrong with this code?

 

Maybe there is a classic comparison error similar to the strcmp function, when one of the comparison arguments is represented by an array and the function returns NULL leading to an incorrect comparison? Let’s check.

No, this is not a comparison error.

For successful exploitation of the vulnerability, the following conditions are required:

 

1. The web application configuration has the following component.

2. ...
   'components'          => [
           'request'    => [
               'parsers'   => [
                   'application/json' => 'yii\web\JsonParser',
   ...

This configuration is often used for REST API applications. 

 

1. The model doesn’t use rules or an incorrect rule configuration is created. Hence, the controller doesn’t validate the incoming parameters. 

This kind of rules is insufficient.

...   
     public function rules()
    {
        return [
            [['name', 'password'], 'required'],
        ];
    }
...

The existing controller doesn’t use validation according to the model rules and those rules are insufficient, which violates the application logic. 

 

Let’s go back to the configuration component ‘application/json’ => ‘yii\web\JsonParser’. This option enables transferring data to the application not only with Content-Type: application/x-www-form-urlencoded, but also in JSON.

 

Here are the example requests to the controller with correct and incorrect passwords:

Everything works as it should—but only at first glance.

 

Active Record sends a database query with the parameters presented in the same format in which the controller received them. The JSON format can pass the following parameter types:

a string.a number.an object (JSON object)an array.a boolean.null.

The system expects a string parameter. If you pass the parameter of another type, this will violate the controller logic.

Let’s pass the password parameter presented as boolean.

Without knowing the correct password, we were able to fulfill the condition indicated in the controller. How did this happen?

 

As mentioned above, Active Record provides the database with the same parameter types it receives. We sent a password value of boolean type and the request turned out to be successful (thanks to MySQL, as well) satisfying the condition indicated in the controller. We got the access.

mysql> select * from user where `name`='admin' and `password` = false;
+-------+--------------------+
| name  | password           |
+-------+--------------------+
| admin | W0o0oO0_very_St0Ng |
+-------+--------------------+
1 row in set (0.00 sec)

Instead of a Conclusion

 

It is worth noting that the Yii2 Framework 2.0.35 itself is not vulnerable, but incorrectly defined rules can lead to data compromise. 

 

To avoid such a compromise, we recommend to:

 

1. Use strict rules() in the model.
2. Apply mandatory validation of parameters before sending them to Active Record methods

 

To make sure that all vulnerabilities are fixed, we encourage you to test your system with the Wallarm WAF scanner. Following this analysis, you’ll be certain that no confidential data could leak from your web applications, microservices, or APIs.

 

Write us to try Wallarm WAF: sales@wallarm.com