CAPEC 108

Summary

Attack Execution Flow

1. Probe for SQL Injection vulernability:

   The attacker injects SQL syntax into user-controllable data inputs to search unfiltered execution of the SQL syntax in a query.

   Indicators

   ID	type	Indicator Description	Environments
   1	Negative	Attacker receives normal response from server.	env-Web env-ClientServer env-Peer2Peer env-CommProtocol
   2	Positive	Attacker receives an error message from server indicating that there was a problem with the SQL query.	env-Web env-ClientServer env-Peer2Peer env-CommProtocol
   3	Negative	Server sends a specific error message that indicates programmatic parsing of the input data (e.g. NumberFormatException)	env-Web env-ClientServer env-Peer2Peer env-CommProtocol

   Outcomes

   ID	type	Outcome Description
   1	Success	At least one user-controllable input susceptible to injection found.
   2	Failure	No user-controllable input susceptible to injection found.

   Security Controls

   ID	type	Security Control Description
   1	Detective	Search for and alert on unexpected SQL keywords in application logs (e.g. SELECT, DROP, etc.).
   2	Preventative	Input validation of user-controlled data before including it in a SQL query
   3	Preventative	Use parameterized queries (e.g. PreparedStatement in Java, and Command.Parameters.Add() to set query parameters in .NET)

1. Achieve arbitrary command execution through SQL Injection with the MSSQL_xp_cmdshell directive:

   The attacker leverages a SQL Injection attack to inject shell code to be executed by leveraging the xp_cmdshell directive.

   Outcomes

   ID	type	Outcome Description
   1	Success	Attacker's injected code is executed.

   Security Controls

   ID	type	Security Control Description
   1	Preventative	Disable xp_cmdshell stored procedure on the database.
   2	Detective	Search for and alert on unexpected SQL keywords in application logs (e.g. SELECT, DROP, etc.).
   3	Preventative	Input validation of user-controlled data before including it in a SQL query
   4	Preventative	Use parameterized queries (e.g. PreparedStatement in Java, and Command.Parameters.Add() to set query parameters in .NET)

2. SecurityDatabase\Alert\Inject malicious data in the database:

   Leverage SQL injection to inject data in the database that could later be used to achieve command injection if ever used as a command line argument

   Security Controls

   ID	type	Security Control Description
   1	Detective	Search for and alert on unexpected SQL keywords in application logs (e.g. SELECT, DROP, etc.).
   2	Preventative	Input validation of user-controlled data before including it in a SQL query
   3	Preventative	Use parameterized queries (e.g. PreparedStatement in Java, and Command.Parameters.Add() to set query parameters in .NET)

3. Trigger command line execution with injected arguments:

   The attacker causes execution of command line functionality which leverages previously injected database content as arguments.

   Outcomes

   ID	type	Outcome Description
   1	Success	Attacker's injected code is executed.

Likelihood: Low

Description

Skill or Knowledge Level: High

The attacker most likely has to be familiar with the internal functionality of the system to launch this attack. Without that knowledge, there are not many feedback mechanisms to give an attacker the indication of how to perform command injection or whether the attack is succeeding.

Disable MSSQL xp_cmdshell directive on the database

Properly validate the data (syntactically and semantically) before writing it to the database.

Do not implicitly trust the data stored in the database. Re-validate it prior to usage to make sure that it is safe to use in a given context (e.g. as a command line argument).

Validate all data syntactically and semantically before writing it to the database

Do not implicitly trust database data and validate it to ensure that it is safe in the context in which it is being used