1852
Scope Impact Likelihood
Integrity
Availability
Access Control
Read Application Data
Modify Application Data
Varies by Context
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Demonstrative Examples
Example 1:
The following code dynamically constructs and executes a SQL query that searches for items
matching a specified name. The query restricts the items displayed to those where owner matches
the user name of the currently-authenticated user.
Example Language: C# (Bad)
...
string userName = ctx.getAuthenticatedUserName();
string query = "SELECT * FROM items WHERE owner = '" + userName + "' AND itemname = '" + ItemName.Text + "'";
sda = new SqlDataAdapter(query, conn);
DataTable dt = new DataTable();
sda.Fill(dt);
...
The query that this code intends to execute follows:
Example Language: (Informative)
SELECT * FROM items WHERE owner = <userName> AND itemname = <itemName>;
However, because the query is constructed dynamically by concatenating a constant base query
string and a user input string, the query only behaves correctly if itemName does not contain a
single-quote character. If an attacker with the user name wiley enters the string:
Example Language: (Attack)
name' OR 'a'='a
for itemName, then the query becomes the following:
Example Language: (Attack)
SELECT * FROM items WHERE owner = 'wiley' AND itemname = 'name' OR 'a'='a';
The addition of the:
Example Language: (Attack)
OR 'a'='a
CWE Version 4.14
CWE-943: Improper Neutralization of Special Elements in Data Query Logic
CWE-943: Improper Neutralization of Special Elements in Data Query Logic