SQL Injection through SOAP Parameter Tampering |
| Attack Pattern ID: 110 (Standard Attack Pattern Completeness: Complete) | Typical Severity: Very High | Status: Draft |
DescriptionSummary
An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message.
Attack Execution Flow
Detect Incorrect SOAP Parameter Handling:
The attacker tampers with the SOAP message parameters and looks for indications that the tampering caused a change in behavior of the targeted application.
Attack Step Techniques
ID Attack Step Technique Description Environments 1 The attacker tampers with the SOAP message parameters by injecting some special characters such as single quotes, double quotes, semi columns, etc. The attacker observes system behavior.
env-WebIndicators
ID type Indicator Description Environments 1 Positive SOAP messages are used as a communication mechanism in the system
env-WebOutcomes
ID type Outcome Description 1 Success Any indication that the injected input is causing system trouble (e.g. stack traces are produced, the system does not respond, etc.) then the attacker may come to conclude that the system is vulnerable to SQL injection through SOAP parameter tampering.
Probe for SQL Injection vulernability:
The attacker injects SQL syntax into vulnerable SOAP parameters identified during the Explore phase to search for unfiltered execution of the SQL syntax in a query.
Indicators
ID type Indicator Description Environments 1 Negative Attacker receives normal response from server.
env-Web env-ClientServer env-Peer2Peer env-CommProtocol2 Positive Attacker receives an error message from server indicating that there was a problem with the SQL query.
env-Web env-ClientServer env-Peer2Peer env-CommProtocol3 Negative Server sends a specific error message that indicates programmatic parsing of the input data (e.g. NumberFormatException)
env-Web env-ClientServer env-Peer2Peer env-CommProtocolOutcomes
ID type Outcome Description 1 Success At least one SOAP parameter susceptible to injection found.2 Failure No SOAP parameter susceptible to injection found.Security Controls
ID type Security Control Description 1 Detective Search for and alert on unexpected SQL keywords in application logs (e.g. SELECT, DROP, etc.).2 Preventative Input validation of SOAP parameter data before including it in a SQL query3 Preventative Use parameterized queries (e.g. PreparedStatement in Java, and Command.Parameters.Add() to set query parameters in .NET)
SecurityDatabase\Alert\Inject SQL via SOAP Parameters:
The attacker injects SQL via SOAP parameters identified as vulnerable during Explore phase to launch a first or second order SQL injection attack.
Attack Step Techniques
ID Attack Step Technique Description Environments 1 An attacker performs a SQL injection attack via the usual methods leveraging SOAP parameters as the injection vector. An attacker has to be careful not to break the XML parser at the service provider which may prevent the payload getting through to the SQL query. The attacker may also look at the WSDL for the web service (if available) to better understand what is expected by the service provider.
env-WebOutcomes
ID type Outcome Description 1 Success Attacker achieves goal of unauthorized system access, denial of service, etc.2 Failure Attacker unable to exploit SQL Injection vulnerability.
Attack PrerequisitesSOAP messages are used as a communication mechanism in the system
SOAP parameters are not properly validated at the service provider
The service provider does not properly utilize parameter binding when building SQL queries
Typical Likelihood of ExploitLikelihood: High
Methods of Attack- Injection
- Analysis
Examples-InstancesDescription
An attacker uses a travel booking system that leverages SOAP communication between the client and the travel booking service. An attacker begins to tamper with the outgoing SOAP messages by modifying their parameters to include characters that would break a dynamically constructed SQL query. He notices that the system fails to respond when these malicious inputs are injected in certain parameters transffered in a SOAP message. The attacker crafts a SQL query that modifies his payment amount in the travel system's database and passes it as one of the parameters . A backend batch payment system later fetches the payment amount from the database (the modified payment amount) and sends to the credit card processor, enabling the attacker to purchase the airfare at a lower price. An attacker needs to have some knowledge of the system's database, perhaps by exploiting another weakness that results in information disclosure.
Attacker Skills or Knowledge RequiredSkill or Knowledge Level: Medium
If the attacker is able to gain good understanding of the system's database schema; High: If the attacker has to perform SQL injection blindly
Resources RequiredNo specialized hardware resources are required
Probing TechniquesSecurityDatabase\Alert\Inject SQL characters in SOAP parameters and observe system behavior
Review WSDL to understand what is expected by the service provider
Solutions and MitigationsProperly validate and sanitize/reject user input at the service provider.
Ensure that prepared statements or other mechanism that enables parameter binding is used when accessing the database in a way that would prevent the attacker's supplied data from controlling the structure of the executed query.
At the database level, ensure that the database user used by the application in a particular context has the minimum needed privileges to the database that are needed to perform the operation. When possible, run queries against pregenerated views rather than the tables directly.
Attack Motivation-Consequences- Data Modification
- Denial of Service
- Information Leakage
- Privilege Escalation
- Run Arbitrary Code
Related Weaknesses Related Attack Patterns| Nature | Type | ID | Name | Description | View(s) this relationship pertains to |
|---|---|---|---|---|---|
| ChildOf |  Attack Pattern | 7 | Blind SQL Injection | Mechanism of Attack (primary)1000 | |
| ChildOf | Attack Pattern | 66 | SQL Injection | Mechanism of Attack (primary)1000 | |
| ChildOf | Attack Pattern | 280 | SOAP Parameter Tampering | Mechanism of Attack (primary)1000 |
Relevant Security RequirementsAlways safely access the database through prepared statements that leverage parameter binding
Properly validate all SOAP parameters to ensure that their values are as expected
Reject bad user input (do not try to sanitize it)
Related Security PrinciplesDefense in Depth
Least Privilege
Related GuidelinesRemember that the client can be made invisible
Purposes- Exploitation
CIA Impact Technical Context| Architectural Paradigms | SOA |
|---|---|
| Frameworks | All |
| Platforms | All |
| Languages | All |
Content History| Submissions | ||||
|---|---|---|---|---|
| Submitter | Organization | Date | Comments | |
| Evgeny Lebanidze | Cigital, Inc | 2008-01-12 | Initial core pattern content | |
| Modifications | |||||
|---|---|---|---|---|---|
| Modifier | Organization | Date | Comments | ||
| Sean Barnum | Cigital Federal, Inc. | 2009-04-20 | Refinement of pattern content | ||
