This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Top 10-2017 A1-Injection"
m (Editorial changes e.g. line feeds, bold or underlined text) |
m (Editorial changes (fixed line feeds)) |
||
Line 20: | Line 20: | ||
<td colspan=2 {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}> | <td colspan=2 {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}> | ||
<!--- Security Weakness: ---> | <!--- Security Weakness: ---> | ||
− | Injection flaws are very prevalent, particularly in legacy code. Injection vulnerabilities are often found in SQL, LDAP, XPath, or NoSQL queries, OS commands, XML parsers, SMTP headers, expression languages, and ORM queries. | + | Injection flaws are very prevalent, particularly in legacy code. Injection vulnerabilities are often found in SQL, LDAP, XPath, or NoSQL queries, OS commands, XML parsers, SMTP headers, expression languages, and ORM queries.<br/>Injection flaws are easy to discover when examining code. Scanners and fuzzers can help attackers find injection flaws. </td> |
− | |||
− | Injection flaws are easy to discover when examining code. Scanners and fuzzers can help attackers find injection flaws. </td> | ||
<td colspan=2 {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}> | <td colspan=2 {{Template:Top_10_2010:SummaryTableRowStyleTemplate|year=2017}}> | ||
<!--- Impacts: ---> | <!--- Impacts: ---> | ||
− | Injection can result in data loss, corruption, or disclosure to unauthorized parties, loss of accountability, or denial of access. Injection can sometimes lead to complete host takeover. | + | Injection can result in data loss, corruption, or disclosure to unauthorized parties, loss of accountability, or denial of access. Injection can sometimes lead to complete host takeover.<br/>The business impact depends on the needs of the application and data.</td> |
− | |||
− | The business impact depends on the needs of the application and data.</td> | ||
{{Top_10_2010:SummaryTableEndTemplate|year=2017}} | {{Top_10_2010:SummaryTableEndTemplate|year=2017}} | ||
Line 51: | Line 47: | ||
String query = "SELECT * FROM accounts WHERE custID='" + request.getParameter("id") + "'"; | String query = "SELECT * FROM accounts WHERE custID='" + request.getParameter("id") + "'"; | ||
</span></b>{{Top_10_2010:ExampleEndTemplate}} | </span></b>{{Top_10_2010:ExampleEndTemplate}} | ||
+ | |||
<b>Scenario #2</b>: Similarly, an application’s blind trust in frameworks may result in queries that are still vulnerable, (e.g. Hibernate Query Language (HQL)): | <b>Scenario #2</b>: Similarly, an application’s blind trust in frameworks may result in queries that are still vulnerable, (e.g. Hibernate Query Language (HQL)): | ||
{{Top_10_2010:ExampleBeginTemplate|year=2017}}<b><span style="color:red;"> | {{Top_10_2010:ExampleBeginTemplate|year=2017}}<b><span style="color:red;"> |
Latest revision as of 16:26, 1 January 2018
Threat Agents / Attack Vectors | Security Weakness | Impacts | |||
---|---|---|---|---|---|
App Specific | Exploitability: 3 |
Prevalence: 2 |
Detectability: 3 |
Technical: 3 |
Business ? |
Almost any source of data can be an injection vector, environment variables, parameters, external and internal web services, and all types of users. Injection flaws occur when an attacker can send hostile data to an interpreter. |
Injection flaws are very prevalent, particularly in legacy code. Injection vulnerabilities are often found in SQL, LDAP, XPath, or NoSQL queries, OS commands, XML parsers, SMTP headers, expression languages, and ORM queries. Injection flaws are easy to discover when examining code. Scanners and fuzzers can help attackers find injection flaws. |
Injection can result in data loss, corruption, or disclosure to unauthorized parties, loss of accountability, or denial of access. Injection can sometimes lead to complete host takeover. The business impact depends on the needs of the application and data. |
Is the Application Vulnerable?
An application is vulnerable to attack when:
|
How to Prevent
Preventing injection requires keeping data separate from commands and queries.
|
Example Attack Scenarios
Scenario #1: An application uses untrusted data in the construction of the following vulnerable SQL call: String query = "SELECT * FROM accounts WHERE custID='" + request.getParameter("id") + "'"; Scenario #2: Similarly, an application’s blind trust in frameworks may result in queries that are still vulnerable, (e.g. Hibernate Query Language (HQL)): Query HQLQuery = session.createQuery("FROM accounts WHERE custID='" + request.getParameter("id") + "'"); In both cases, the attacker modifies the ‘id’ parameter value in their browser to send: ' or '1'='1. For example:
http://example.com/app/accountView?id=' or '1'='1
This changes the meaning of both queries to return all the records from the accounts table. More dangerous attacks could modify or delete data, or even invoke stored procedures. |
References
OWASP
External |
![CC-by-sa-3 0-88x31.png](/images/6/64/CC-by-sa-3_0-88x31.png)