Weaknesses in this category are typically introduced during the configuration of the software. 1000 Category ChildOf 1 635 View ChildOf 635 Weaknesses in this category are related to improper calculation or conversion of numbers. 1000 Category ChildOf 19 635 View ChildOf 635 Numeric Errors All Weaknesses in this category are related to the management of credentials. 1000 Category ChildOf 254 635 View ChildOf 635 All Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control. Follow the principle of least privilege when assigning access rights to entities in a software system. 1000 Category ChildOf 254 635 View ChildOf 635 Permissions, Privileges, and ACLs All 35 17 76 58 5 69 Weaknesses in this category are related to the use of cryptography. Cryptography This category is incomplete and needs refinement, as there is good documentation of cryptographic flaws and related attacks. Note: some of these can be resultant. 1000 Category ChildOf 254 635 View ChildOf 635 Cryptographic Issues All Weaknesses in this category are related to improper management of system resources. Resource management errors can lead to consumption, exhaustion, etc. Often a resultant vulnerability 1000 Weakness ChildOf 398 635 View ChildOf 635 Resource Management Errors All The software may potentially allow operations, such as reading or writing, to be performed at addresses not intended by the developer. When software permits read or write operations on memory located outside of an allocated range, an attacker may be able to access/modify sensitive information, cause the system to crash, alter the intended control flow, or execute arbitrary code. Memory 1000 Weakness ChildOf 118 635 View ChildOf 635 631 Category ChildOf 633 100 10 14 42 24 8 44 9 45 46 47 The software uses externally-controlled format strings in printf-style functions, which can lead to buffer overflows or data representation problems. logging, errors, general output Very High Primary (Weakness exists independent of other weaknesses) Implicit (This is an implicit weakness) Memory Confidentiality: Format string problems allow for information disclosure which can severely simplify exploitation of the program. Access Control: Format string problems can result in the execution of arbitrary code. Requirements specification: Choose a language which is not subject to this flaw. Implementation: Ensure that all format string functions are passed a static string which cannot be controlled by the user and that the proper number of arguments are always sent to that function as well. If at all possible, do not use the %n operator in format strings. Build: Heed the warnings of compilers and linkers, since they may alert you to improper usage. The following example is exploitable, due to the printf() call in the printWrapper() function. Note: The stack buffer was added to make exploitation more simple. C ]]> The following code copies a command line argument into a buffer using snprintf(). This code allows an attacker to view the contents of the stack and write to the stack using a command line argument containing a sequence of formatting directives. The attacker can read from the stack by providing more formatting directives, such as %x, than the function takes as arguments to be formatted. (In this example, the function takes no arguments to be formatted.) By using the %n formatting directive, the attacker can write to the stack, causing snprintf() to write the number of bytes output thus far to the specified argument (rather than reading a value from the argument, which is the intended behavior). A sophisticated version of this attack will use four staggered writes to completely control the value of a pointer on the stack. Certain implementations make more advanced attacks even easier by providing format directives that control the location in memory to read from or write to. An example of these directives is shown in the following code, written for glibc: This code produces the following output: 5 9 5 5 It is also possible to use half-writes (%hn) to accurately control arbitrary DWORDS in memory, which greatly reduces the complexity needed to execute an attack that would otherwise require four staggered writes, such as the one mentioned in the first example. CVE-2002-1825 format string in Perl program CVE-2001-0717 format string in bad call to syslog function CVE-2002-0573 format string in bad call to syslog function CVE-2002-1788 format strings in NNTP server responses CVE-2007-2027 Chain: untrusted search path enabling resultant format string by loading malicious internationalization messages While Format String vulnerabilities typically fall under the Buffer Overflow category, technically they are not overflowed buffers. The Format String vulnerability is fairly new (circa 1999) and stems from the fact that there is no realistic way for a function that takes a variable number of arguments to determine just how many arguments were passed in. The most common functions that take a variable number of arguments, including C-runtime functions, are the printf() family of calls. The Format String problem appears in a number of ways. A *printf() call without a format specifier is dangerous and can be exploited. For example, printf(input); is exploitable, while printf(y, input); is not exploitable in that context. The result of the first call, used incorrectly, allows for an attacker to be able to peek at stack memory since the input string will be used as the format specifier. The attacker can stuff the input string with format specifiers and begin reading stack values, since the remaining parameters will be pulled from the stack. Worst case, this improper use may give away enough control to allow an arbitrary value (or values in the case of an exploit program) to be written into the memory of the running program Frequently targeted entities are file names, process names, identifiers Format string problems are a classic C/C++ issue that are now rare due to the ease of discovery. The reason format string vulnerabilities can be exploited is due to the %n operator. The %n operator will write the number of characters, which have been printed by the format string therefore far, to the memory pointed to by its argument. Through skilled creation of a format string, a malicious user may use values on the stack to create a write-what-where condition. Once this is achieved, he can execute arbitrary code. Format string issues are under-studied for languages other than C. Memory or disk consumption, control flow or variable alteration, and data corruption may result from format string exploitation in applications written in other languages such as Perl, PHP, Python, etc. Since format strings often occur in rarely-occurring erroneous conditions, it is highly that many latent issues exist in executables that do not have associated source code (or equivalent source). Steve Christey Format String Vulnerabilities in Perl Programs http://www.securityfocus.com/archive/1/418460/30/0/threaded Hal Burch Robert C. Seacord Programming Language Format String Vulnerabilities http://www.ddj.com/dept/security/197002914 Tim Newsham Format String Attacks Guardent September 2000 http://www.lava.net/~newsham/format-string-attacks.pdf 1000 Category ChildOf 133 1000 Weakness ChildOf 74 1000 Weakness PeerOf 123 630 View ChildOf 630 631 Category ChildOf 633 635 View ChildOf 635 Format string vulnerability Format String Format string problem All Implementation 67 A weakness where the code path has: 1. start statement that accepts input 2. end statement that passes a format to format output function where a. the input data is part of the format and b. the format is undesirable Where “undesirable” is defined through the following scenarios: 1. not validated 2. incorrectly validated The product has an absent or incorrect protection mechanism that fails to properly validate input that can affect the control flow or data flow of a program. One should validate input from untrusted sources before it is used. The untrusted data sources can be HTTP requests, file systems, databases, and any external systems that provide data to the application. In the case of HTTP requests, validate all parts of the request, including headers, form fields, cookies, and URL components that are used to transfer information from the browser to the server side application. Duplicate any client-side checks on the server side. This should be simple to implement in terms of time and difficulty, and will greatly reduce the likelihood of insecure parameter values being used in the application. Assume all input is malicious. Use an appropriate combination of black lists and white lists to ensure only valid and expected input is processed by the system. In the context of web-applications it is particularly important to have adequate validation in place. Note that client-side checks should not be considered a secure means of validating parameters. These checks only help reduce the amount of server processing time for normal users who do not know the format of required input. It is a very minimal savings in terms of time. Attackers can bypass these mechanisms easily by intercepting parameters after the client-side checks and altering the values before they are submitted to the server. 1000 Category ChildOf 19 1000 Weakness ChildOf 693 635 View ChildOf 635 Input validation and representation 10 31 13 32 14 52 71 53 72 18 91 73 78 79 99 101 22 24 42 43 80 45 63 81 28 46 64 47 83 66 67 85 86 88 3 7 8 9 An information leak is the intentional or unintentional disclosure of information that either (1) is regarded as sensitive within the product's own functionality, such as a private message, or (2) provides information about the product or its environment that could be useful in an attack but is normally not available to the attacker, such as the installation path of a product that is remotely accessible. Many information leaks are resultant (e.g. path disclosure in PHP script error), but they can also be primary (e.g. timing discrepancies in crypto). There are many different types of problems that involve information leaks. Their severity can range widely depending on the type of information that is leaked. Compartmentalize your system to have "safe" areas where trust boundaries can be unambiguously drawn. Do not allow sensitive data to go outside of the trust boundary and always be careful when interfacing with a compartment outside of the safe area. 1000 Category ChildOf 199 629 View ChildOf 629 635 View ChildOf 635 Information Leak (information disclosure) All 79 22 13 60 59 The software, when constructing file or directory names from input, does not properly sanitize special character sequences that resolve to a file or directory name that is outside of the intended directory or directories. Directory traversal "Path traversal" is preferred over "directory traversal." Like other Weaknesses, terminology is often based on the types of manipulations used, instead of the underlying Weaknesses. Some people use "directory traversal" only to refer to the injection of ".." and equivalent sequences whose specific meaning is to traverse directories. Other variants like "absolute pathname" and "drive letter" have the *effect* of directory traversal, but some people may not call it such, since it doesn't involve ".." or equivalent. File processing Primary (Weakness exists independent of other weaknesses) Explicit (This is an explicit weakness resulting from behavior of the developer) File/Directory Assume all input is malicious. Attackers can insert paths into input vectors and traverse the file system. Use an appropriate combination of black lists and white lists to ensure only valid and expected input is processed by the system. Warning: if you attempt to cleanse your data, then do so that the end result is not in the form that can be dangerous. A sanitizing mechanism can remove characters such as ‘.' and ‘;' which may be required for some exploits. An attacker can try to fool the sanitizing mechanism into "cleaning" data into a dangerous form. Suppose the attacker injects a ‘.' inside a filename (e.g. "sensi.tiveFile") and the sanitizing mechanism removes the character resulting in the valid filename, "sensitiveFile". If the input data are now assumed to be safe, then the file may be compromised. Pathname equivalence can be regarded as a type of canonicalization error. Some pathname equivalence issues are not directly related to directory traversal, rather are used to bypass security-relevant checks for whether a file/directory can be accessed by the attacker (e.g. a trailing "/" on a filename could bypass access rules that don't expect a trailing /, causing a server to provide the file when it normally would not). Incomplete diagnosis or reporting of vulnerabilities can make it difficult to know which variant is affected. For example, a researcher might say that "..\" is vulnerable, but not test "../" which may also be vulnerable. Any combination of the items below can provide its own variant, e.g. "//../" is not listed (CVE-2004-0325). Most of these issues are probably under-studied 1000 Weakness ChildOf 21 1000 Weakness ChildOf 610 629 View ChildOf 629 631 Category ChildOf 632 635 View ChildOf 635 Path Traversal All 76 23 The software does not properly ensure that the user has proven their identity. An alternate term is "authentification", which appears to be most commonly used by people from non-English-speaking countries. Authentication Authentication bypass This can be resultant from SQL injection vulnerabilities and other issues. 1000 Category ChildOf 254 629 View ChildOf 629 635 View ChildOf 635 Authentication Error All 57 22 94 The code does not properly control when an unmodifiable state is required between two operations, but a timing window exists in which the state can be modified by an untrusted actor or process. 635 Weakness ChildOf 691 1000 Category ChildOf 361 635 View ChildOf 635 Race Conditions 26 29 Link following weaknesses involve insufficient protection against links or shortcuts that can resolve to a file other than the one that was intended. Some people use the phrase "insecure temporary file" when referring to a link following weakness, but other weaknesses can produce insecure temporary files without any symlink involvement at all. File processing, temporary files Low to Medium Resultant (Weakness is typically related to the presence of some other weaknesses) Explicit (This is an explicit weakness resulting from behavior of the developer) File/Directory Follow the principle of least privilege when assigning access rights to files. Denying access to a file can prevent an attacker from replacing that file with a link to a sensitive file. Ensure good compartmentalization in the system to provide protected areas that can be trusted. Link following vulnerabilities are Multi-factor Vulnerabilities (MFV). They are the combination of multiple elements: file or directory permissions, filename predictability, race conditions, and in some cases, a design limitation in which there is no mechanism for performing atomic file creation operations. Some potentials factors are race conditions, permissions, predictability. This is not OS specific. Windows soft links can be exploited remotely since a ".LNK" file can be uploaded like a normal file. UNIX hard links, and Windows hard/soft links are under-studied and under-reported. 1000 Weakness ChildOf 21 631 Category ChildOf 632 635 View ChildOf 635 Link Following All 35 17 76 The software fails to adequately filter OS command syntax from user-controlled input and then allows potentially injected commands to execute within its context. A software system that accepts and executes input in the form of operating system commands (e.g. system(), exec(), open()) could allow an attacker with lesser privileges than the target software to execute commands with the elevated privileges of the executing process. The problem is exacerbated if the compromised process fails to follow the principle of least privilege. Shell injection, shell metacharacters Program invocation System Process Design: If at all possible, use library calls rather than external processes to recreate the desired functionality Implementation: Utilize black-list parsing to filter non-relevant OS command syntax from all input. Implementation: Ensure that all external commands called from the program are statically created, or -- if they must take input from a user -- that the input and final line generated are vigorously white-list checked. Run time: Run time policy enforcement may be used in a white-list fashion to prevent use of any non-sanctioned commands. Assign permissions to the software system that prevents the user from accessing/opening privileged files. CVE-1999-0067 CVE-2001-1246 CVE-2002-0061 CVE-2003-0041 CVE-2002-1898 Shell metacharacters in a telnet:// link (this is a multi-factor vulnerability, CVE-2007-3572 Chain: incomplete blacklist for OS command injection Fault: unquoted special characters, input restriction error G. Hoglund G. McGraw Exploiting Software: How to Break Code Addison-Wesley February 2004 1000 Weakness ChildOf 77 1000 Weakness CanAlsoBe 88 629 View ChildOf 629 630 View ChildOf 630 631 Category ChildOf 634 635 View ChildOf 635 OS Command Injection All 88 15 6 43 A weakness where the code path has: 1. start statement that accepts input 2. end statement that executes an operating system command where a. the input is used as a part of the operating system command b. the privilege of the operating system command is higher than privilege of the input and c. the operating system command is undesirable Where “undesirable” is defined through the following scenarios: 1. not validated 2. incorrectly validated The software does not sufficiently sanitize user-controllable input for content before it is prepared in output that is used as a web page. Unsanitized special elements that have control implications in web pages, such as HTML tags or mouse events, are interpreted as control characters that execute in violation of the client's trust in the application or system. This weakness usually enables cross-site scripting attacks in web applications. "CSS" was once used as the acronym for this problem, but this can cause confusion with the "Cascading Style Sheets," so this acronym has declined significantly. Its use is discouraged by CWE. High to Very High Resultant (Weakness is typically related to the presence of some other weaknesses) Explicit (This is an explicit weakness resulting from behavior of the developer) Confidentiality: The most common attack performed with cross-site scripting involves the disclosure of information stored in user cookies. Access control: In some circumstances it may be possible to run arbitrary code on a victim's computer when cross-site scripting is combined with other flaws. If successful, cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Carefully check each input parameter against a rigorous positive specification (white list) defining the specific characters and format allowed. All input should be sanitized, not just parameters that the user is supposed to specify, but all data in the request, including hidden fields, cookies, headers, the URL itself, and so forth. A common mistake that leads to continuing XSS vulnerabilities is to validate only fields that are expected to be redisplayed by the site. We often encounter data from the request that is reflected by the application server or the application that the development team did not anticipate. Also, a field that is not currently reflected may be used by a future developer. Therefore, validating ALL parts of the HTTP request is recommended. This involves "HTML Entity Encoding" all non-alphanumeric characters from data that was received from the user and is now being written to the request. With Struts, you should write all data from form beans with the bean's filter attribute set to true. To help mitigate XSS attacks against the user's session cookie, set the session cookie to be HttpOnly. In browsers that support the HttpOnly feature (such as Internet Explorer), this attribute prevents the user's session cookie from being accessed by client-side scripts, including scripts inserted due to a XSS attack. The following JSP code segment reads an employee ID, eid, from an HTTP request and displays it to the user. JSP ... Em]]>]]> The following ASP.NET code segment reads an employee ID number from an HTTP request and displays it to the user. ASP.NET The code in this example operates correctly if eid contains only standard alphanumeric text. If eid has a value that includes meta-characters or source code, then the code will be executed by the web browser as it displays the HTTP response. Initially this might not appear to be much of a vulnerability. After all, why would someone enter a URL that causes malicious code to run on their own computer? The real danger is that an attacker will create the malicious URL, then use e-mail or social engineering tricks to lure victims into visiting a link to the URL. When victims click the link, they unwittingly reflect the malicious content through the vulnerable web application back to their own computers. This mechanism of exploiting vulnerable web applications is known as Reflected XSS. The following JSP code segment queries a database for an employee with a given ID and prints the corresponding employee's name. JSP ]]>]]> The following ASP.NET code segment queries a database for an employee with a given employee ID and prints the name corresponding with the ID. ASP.NET This code functions correctly when the values of name are well-behaved, but it does nothing to prevent exploits if they are not. Again, this code can appear less dangerous because the value of name is read from a database, whose contents are apparently managed by the application. However, if the value of name originates from user-supplied data, then the database can be a conduit for malicious content. Without proper input validation on all data stored in the database, an attacker can execute malicious commands in the user's web browser. This type of exploit, known as Stored XSS, is particularly insidious because the indirection caused by the data store makes it more difficult to identify the threat and increases the possibility that the attack will affect multiple users. XSS got its start in this form with web sites that offered a "guestbook" to visitors. Attackers would include JavaScript in their guestbook entries, and all subsequent visitors to the guestbook page would execute the malicious code. As the examples demonstrate, XSS vulnerabilities are caused by code that includes unvalidated data in an HTTP response. There are three vectors by which an XSS attack can reach a victim: * As in the previous example, data is read directly from the HTTP request and reflected back in the HTTP response. Reflected XSS exploits occur when an attacker causes a user to supply dangerous content to a vulnerable web application, which is then reflected back to the user and executed by the web browser. The most common mechanism for delivering malicious content is to include it as a parameter in a URL that is posted publicly or e-mailed directly to victims. URLs constructed in this manner constitute the core of many phishing schemes, whereby an attacker convinces victims to visit a URL that refers to a vulnerable site. After the site reflects the attacker's content back to the user, the content is executed and proceeds to transfer private information, such as cookies that may include session information, from the user's machine to the attacker or perform other nefarious activities. * As in this example, the application stores dangerous data in a database or other trusted data store. The dangerous data is subsequently read back into the application and included in dynamic content. Stored XSS exploits occur when an attacker injects dangerous content into a data store that is later read and included in dynamic content. From an attacker's perspective, the optimal place to inject malicious content is in an area that is displayed to either many users or particularly interesting users. Interesting users typically have elevated privileges in the application or interact with sensitive data that is valuable to the attacker. If one of these users executes malicious content, the attacker may be able to perform privileged operations on behalf of the user or gain access to sensitive data belonging to the user. * A source outside the application stores dangerous data in a database or other data store, and the dangerous data is subsequently read back into the application as trusted data and included in dynamic content. CVE-2007-5727 Chain: only removes SCRIPT tags, enabling XSS CVE-2006-4308 Chain: only checks "javascript:" tag Cross-site scripting weakness occurs when dynamically generated web pages display input, such as login information, that is not properly validated, allowing an attacker to embed malicious scripts into the generated page and then execute the script on the machine of any user that views the site. If successful, Cross-site scripting vulnerabilities can be exploited to manipulate or steal cookies, create requests that can be mistaken for those of a valid user, compromise confidential information, or execute malicious code on the end user systems for a variety of nefarious purposes. Cross-site scripting (XSS) vulnerabilities occur when an attacker uses a web application to send malicious code, generally JavaScript, to a different end user. When a web application uses input from a user in the output it generates without filtering it, an attacker can insert an attack in that input and the web application sends the attack to other users. The end user trusts the web application, and the attacks exploit that trust to do things that would not normally be allowed. Attackers frequently use a variety of methods to encode the malicious portion of the tag, such as using Unicode, so the request looks less suspicious to the user. XSS attacks can generally be categorized into two categories: stored and reflected. Stored attacks are those where the injected code is permanently stored on the target servers in a database, message forum, visitor log, and so forth. Reflected attacks are those where the injected code takes another route to the victim, such as in an email message, or on some other server. When a user is tricked into clicking a link or submitting a form, the injected code travels to the vulnerable web server, which reflects the attack back to the user's browser. The browser then executes the code because it came from a 'trusted' server. For a reflected XSS attack to work, the victim must submit the attack to the server. This is still a very dangerous attack given the number of possible ways to trick a victim into submitting such a malicious request, including clicking a link on a malicious Web site, in an email, or in an inner-office posting. XSS flaws are very likely in web applications, as they require a great deal of developer discipline to avoid them in most applications. It is relatively easy for an attacker to find XSS vulnerabilities. Some of these vulnerabilities can be found using scanners, and some exist in older web application servers. The consequence of an XSS attack is the same regardless of whether it is stored or reflected. The difference is in how the payload arrives at the server. XSS can cause a variety of problems for the end user that range in severity from an annoyance to complete account compromise. The most severe XSS attacks involve disclosure of the user's session cookie, which allows an attacker to hijack the user's session and take over their account. Other damaging attacks include the disclosure of end user files, installation of Trojan horse programs, redirecting the user to some other page or site, and modifying presentation of content. Cross-site scripting (XSS) vulnerabilities occur when: 1. Data enters a Web application through an untrusted source, most frequently a web request. 2. The data is included in dynamic content that is sent to a web user without being validated for malicious code. The malicious content sent to the web browser often takes the form of a segment of JavaScript, but may also include HTML, Flash or any other type of code that the browser may execute. The variety of attacks based on XSS is almost limitless, but they commonly include transmitting private data like cookies or other session information to the attacker, redirecting the victim to web content controlled by the attacker, or performing other malicious operations on the user's machine under the guise of the vulnerable site. Cross-site scripting attacks can occur wherever an untrusted user has the ability to publish content to a trusted web site. Typically, a malicious user will craft a client-side script, which -- when parsed by a web browser -- performs some activity (such as sending all site cookies to a given E-mail address). If the input is unchecked, this script will be loaded and run by each user visiting the web site. Since the site requesting to run the script has access to the cookies in question, the malicious script does also. There are several other possible attacks, such as running "Active X" controls (under Microsoft Internet Explorer) from sites that a user perceives as trustworthy; cookie theft is however by far the most common. All of these attacks are easily prevented by ensuring that no script tags -- or for good measure, HTML tags at all -- are allowed in data to be posted publicly. Cross-site scripting attacks may occur anywhere that possibly malicious users are allowed to post unregulated material to a trusted web site for the consumption of other valid users. The most common example can be found in bulletin-board web sites which provide web based mailing list-style functionality. Jeremiah Grossman Robert "RSnake" Hansen Petko "pdp" D. Petkov Anton Rager Seth Fogie XSS Attacks Syngress 2007 M. Howard D. LeBlanc Writing Secure Code 2nd Edition Microsoft 2003 1000 Weakness ChildOf 74 1000 Weakness CanPrecede 494 1000 Compound_Element PeerOf 352 629 View ChildOf 629 635 View ChildOf 635 1000 692 Compound_Element CanPrecede 692 Cross-site scripting (XSS) Cross-site Scripting Cross-site scripting All 91 19 85 32 86 The application fails to adequately filter SQL syntax from user-controllable input. This can lead to such input being interpreted as SQL rather than ordinary user data and be executed as part of a dynamically generated SQL query. This is a specific form of an injection problem, one that explicitly affects SQL databases, in which SQL commands are injected into data-plane input in order to effect the execution of dynamically generated SQL statements. Very High Confidentiality: Since SQL databases generally hold sensitive data, loss of confidentiality is a frequent problem with SQL injection vulnerabilities. Authentication: If poor SQL commands are used to check user names and passwords, it may be possible to connect to a system as another user with no previous knowledge of the password. Authorization: If authorization information is held in a SQL database, it may be possible to change this information through the successful exploitation of a SQL injection vulnerability. Integrity: Just as it may be possible to read sensitive information, it is also possible to make changes or even delete this information with a SQL injection attack. Requirements specification: A non-SQL style database which is not subject to this flaw may be chosen. Design: Follow the principle of least privilege when creating user accounts to a SQL database. Users should only have the minimum privileges necessary to use their account. If the requirements of the system indicate that a user can read and modify their own data, then limit their privileges so they cannot read/write others' data. Design: Duplicate any filtering done on the client-side on the server side. Implementation: Implement SQL strings using prepared statements that bind variables. Prepared statements that do not bind variables can be vulnerable to attack. Implementation: Use vigorous white-list style checking on any user input that may be used in a SQL command. Rather than escape meta-characters, it is safest to disallow them entirely. Reason: Later use of data that have been entered in the database may neglect to escape meta-characters before use. Narrowly define the set of safe characters based on the expected value of the parameter in the request. The following code dynamically constructs and executes a SQL query that searches for items matching a specified name. The query restricts the items displayed to those where owner matches the user name of the currently-authenticated user. C# The query that this code intends to execute follows: SELECT * FROM items WHERE owner = <userName> AND itemname = <itemName>; However, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if itemName does not contain a single-quote character. If an attacker with the user name wiley enters the string "name' OR 'a'='a" for itemName, then the query becomes the following: SELECT * FROM items WHERE owner = 'wiley' AND itemname = 'name' OR 'a'='a'; The addition of the OR 'a'='a' condition causes the where clause to always evaluate to true, so the query becomes logically equivalent to the much simpler query: SELECT * FROM items; This simplification of the query allows the attacker to bypass the requirement that the query only return items owned by the authenticated user; the query now returns all entries stored in the items table, regardless of their specified owner. This example examines the effects of a different malicious value passed to the query constructed and executed in the above example. If an attacker with the user name hacker enters the string "hacker'); DELETE FROM items; --" for itemName, then the query becomes the following two queries: SQL Many database servers, including Microsoft(R) SQL Server 2000, allow multiple SQL statements separated by semicolons to be executed at once. While this attack string results in an error on Oracle and other database servers that do not allow the batch-execution of statements separated by semicolons, on databases that do allow batch execution, this type of attack allows the attacker to execute arbitrary commands against the database. Notice the trailing pair of hyphens (--), which specifies to most database servers that the remainder of the statement is to be treated as a comment and not executed [19]. In this case the comment character serves to remove the trailing single-quote left over from the modified query. On a database where comments are not allowed to be used in this way, the general attack could still be made effective using a trick similar to the one shown in Example 1. If an attacker enters the string "name'); DELETE FROM items; SELECT * FROM items WHERE owner = 'wiley' AND itemname = 'name'; DELETE FROM items; SELECT * FROM items WHERE 'a'='a'; One traditional approach to preventing SQL injection attacks is to handle them as an input validation problem and either accept only characters from a whitelist of safe values or identify and escape a blacklist of potentially malicious values. Whitelisting can be a very effective means of enforcing strict input validation rules, but parameterized SQL statements require less maintenance and can offer more guarantees with respect to security. As is almost always the case, blacklisting is riddled with loopholes that make it ineffective at preventing SQL injection attacks. For example, attackers can: - Target fields that are not quoted - Find ways to bypass the need for certain escaped meta-characters - Use stored procedures to hide the injected meta-characters Manually escaping characters in input to SQL queries can help, but it will not make your application secure from SQL injection attacks. Another solution commonly proposed for dealing with SQL injection attacks is to use stored procedures. Although stored procedures prevent some types of SQL injection attacks, they fail to protect against many others. For example, the following PL/SQL procedure is vulnerable to the same SQL injection attack shown in the first example. procedure get_item ( itm_cv IN OUT ItmCurTyp, usr in varchar2, itm in varchar2) is open itm_cv for ' SELECT * FROM items WHERE ' || 'owner = '|| usr || ' AND itemname = ' || itm || '; end get_item; Stored procedures typically help prevent SQL injection attacks by limiting the types of statements that can be passed to their parameters. However, there are many ways around the limitations and many interesting statements that can still be passed to stored procedures. Again, stored procedures can prevent some exploits, but they will not make your application secure against SQL injection attacks. MS SQL has a built in function that enables shell command execution. An SQL injection in such a context could be disastrous. For example, a query of the form: Where $user_input is taken from the user and unfiltered. If the user provides the string: The query will take the following form: " Now, this query can be broken down into: [1] a first SQL query: SELECT ITEM,PRICE FROM PRODUCT WHERE ITEM_CATEGORY='' [2] a second SQL query, which executes a shell command: exec master..xp_cmdshell 'vol' [3] an MS SQL comment: --' ORDER BY PRICE As can be seen, the malicious input changes the semantics of the query into a query, a shell command execution and a comment. CVE-2004-0366 CVE-2004-0343 CVE-2003-0779 CVE-2003-0500 CVE-2003-0377 SQL injection has become a common issue with database-driven web sites. The flaw is easily detected, and easily exploited, and as such, any site or software package with even a minimal user base is likely to be subject to an attempted attack of this kind. Essentially, the attack is accomplished by placing a meta character into data input to then place SQL commands in the control plane, which did not exist there before. This flaw depends on the fact that SQL makes no real distinction between the control and data planes. If successful, SQL Injection attacks can give an attacker access to backend database contents, the ability to remotely execute system commands, or in some circumstances the means to take control of the Windows server hosting the database. Dynamically generating queries that include user input can lead to SQL injection attacks. An attacker can insert SQL commands or modifiers in the user input that can cause the query to behave in an unsafe manner. Constructing a dynamic SQL statement with user input may allow an attacker to modify the statement's meaning or to execute arbitrary SQL commands. Factors: resultant to special character mismanagement, MAID, or blacklist/whitelist problems. Can be primary to authentication errors. M. Howard D. LeBlanc Writing Secure Code 2nd Edition Microsoft 2003 1000 Weakness ChildOf 74 629 View ChildOf 629 630 View ChildOf 630 635 View ChildOf 635 SQL injection SQL Injection SQL injection All 66 7 A weakness where the code path has: 1. start statement that accepts input 2. end statement that performs an SQL command where a. the input is part of the SQL command and b. the SQL command is undesirable Where “undesirable” is defined through the following scenarios: 1. not validated 2. incorrectly validated The product does not sufficiently filter code (control-plane) syntax from user-controlled input (data plane) when that input is used within code that the product generates. Implementation: Utilize an appropriate mix of whitelist and blacklist parsing to filter non-relevant code syntax from all input that should not contain code. Run time: Run time policy enforcement may be used in a whitelist fashion to prevent execution of any non-sanctioned code. Assign permissions to the software system that prevent the user from accessing/opening privileged files. Many of these weaknesses are under-studied, and terminology is not sufficiently precise. 1000 Weakness ChildOf 74 1000 Weakness ChildOf 691 635 View ChildOf 635 (CODE) Code Evaluation and Injection All 35 77 The web product does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. Note: CSRF is multi-channel: 1. Attacker-to-victim (injection; external or internal channel) 2. Victim-to-server (activation; internal channel) Session Riding Cross Site Reference Forgery XSRF CVE-2004-1703 CVE-2004-1995 CVE-2004-1967 CVE-2004-1842 CVE-2005-1947 CVE-2005-2059 CVE-2005-1674 CSRF Could be resultant from XSS, although XSS is not necessarily required. Peter W Cross-Site Request Forgeries (Re: The Dangers of Allowing Users to Post Images) Bugtraq http://marc.info/?l=bugtraq&m=99263135911884&w=2 Robert Auger CSRF - The Cross-Site Request Forgery (CSRF/XSRF) FAQ http://www.cgisecurity.com/articles/csrf-faq.shtml 1000 Weakness ChildOf 345 1000 Weakness Requires 346 1000 Weakness Requires 441 1000 Weakness Requires 642 1000 Weakness Requires 613 629 View ChildOf 629 635 View ChildOf 635 Cross-Site Request Forgery (CSRF) All Architecture and Design 62