Theodore Lawson CSCE548 Student Presentation, Topic #2 CWE-89 SQL Injection Theodore Lawson CSCE548 Student Presentation, Topic #2

Technical Overview Software constructs part of SQL commands from user-controllable inputs Software does not clean up elements from user that could end up modifying components downstream User inputs may alter logic to bypass security checkpoints, or insert statements that modify the back end database

Technical Overview Weakness Prevalence High SQL makes no distinction between the control and data planes. Mitigation Cost Low proper architecture and design. Attack Frequency high flaw is very easy to detect and exploit.

Technical Overview Consequences Data Loss Security Bypass Ease of Detection Automated Static Analysis Manual Analysis Attacker Awareness High Common flaw in data-rich applications

Examples Code intends to execute: SELECT * FROM items WHERE owner = <userName> AND itemname = <itemName>; If the attacker with the username Ted enters the string: name' OR 'a'='a Query becomes SELECT * FROM items WHERE owner = ‘ted' AND itemname = 'name' OR 'a'='a'; Which always evaluates true, and essentially becomes SELECT * FROM items;

Examples Confidentiality Loss of sensitive data Authentication Access account of other users Authorization Improper changing of information Integrity Delete information

Detection Methods Automated Static Analysis Advantages False Positives False Negatives Manual Analysis Disadvantages

Avoidance of Error Using proper languages, libraries, and frameworks Hibernate Enterprise Java Beans Separation between data and code Principle of Least Privilege

Conclusion Importance Easily exploited Easily avoided Relevance Potential damage Attacker awareness What we can do Be aware Use tools to detect

References 2011 CWE/SANS Top 25 Most Dangerous Software Errors https://cwe.mitre.org/top25/index.html#CWE-89 Improper Sanitization of Special Elements used in an SQL Command ('SQL Injection’) https://www.security-database.com/cwe.php?name=CWE-89 SQL Injection Examples http://www.w3schools.com/sql/sql_injection.asp