Page History

...

Suppose a system authenticates users by issuing the following query to a SQL database. If the query returns any results, authentication succeeds; otherwise, authentication fails.

SELECT * FROM db_user WHERE username='<USERNAME>' AND 
                            password='<PASSWORD>'

Suppose an attacker can substitute arbitrary strings for <USERNAME> and <PASSWORD>. In that case, the authentication mechanism can be bypassed by supplying the following <USERNAME> with an arbitrary password:

validuser' OR '1'='1

The authentication routine dynamically constructs the following query:

SELECT * FROM db_user WHERE username='validuser' OR '1'='1' AND password='<PASSWORD>'

...

Similarly, an attacker could supply the following string for <PASSWORD> with an arbitrary username:

' OR '1'='1

producing the following query:

SELECT * FROM db_user WHERE username='<USERNAME>' AND password='' OR '1'='1'

...

Failure to sanitize user input before processing or storing it can result in injection attacks.

Automated Detection

Tool	Version	Checker	Description

Image Removed

The Checker Framework

Include Page The Checker Framework_V The Checker Framework_V

Tainting Checker

Trust and security errors (see Chapter 8)

Image Removed

CodeSonar

Include Page CodeSonar_V CodeSonar_V

FB

JAVA.

SECURITY.SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING
FB.SECURITY.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTEA prepared statement is generated from a nonconstant String
Nonconstant string passed to execute method on an SQL statement

IO.INJ.SQL	SQL Injection (Java)
Coverity	7.5	SQLI FB.SQL_PREPARED_STATEMENT_GENERATED_ FB.SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE	Implemented
Findbugs	1.0	SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE	Implemented
Fortify	1.0	HTTP_Response_Splitting SQL_Injection__Persistence SQL_Injection	Implemented
Klocwork

 SV.DATA.BOUND

Include Page Klocwork_V Klocwork_V

SV.DATA.DB SV.

HTTP_SPLIT SV.PATH.INJ
SV.SQL

SQL SV.

PATH

SQL.DBSOURCE

Implemented

Parasoft Jtest

9.5BD-SECURITY-TDSQLImplemented

	Include Page Parasoft_V Parasoft_V	CERT.IDS00.TDSQL	Protect against SQL injection
SonarQube

Image Removed

Include Page SonarQube

Java Plugin

_V SonarQube

Java Plugin

_V	S2077 S3649	Executing SQL queries is security-sensitive SQL queries should not be vulnerable to injection attacks
SpotBugs	Include Page SpotBugs_V SpotBugs_V	SQL_NONCONSTANT_STRING_PASSED_TO_EXECUTE SQL_PREPARED_STATEMENT_GENERATED_FROM_NONCONSTANT_STRING	Implemented

Related Vulnerabilities

CVE-2008-2370 describes a vulnerability in Apache Tomcat 4.1.0 through 4.1.37, 5.5.0 through 5.5.26, and 6.0.0 through 6.0.16. When a RequestDispatcher is used, Tomcat performs path normalization before removing the query string from the URI, which allows remote attackers to conduct directory traversal attacks and read arbitrary files via a .. (dot dot) in a request parameter.

Related Guidelines

Android Implementation Details

This rule uses Microsoft SQL Server as an example to show a database connection. However, on Android, DatabaseHelper from SQLite is used for a database connection. Because Android apps may receive untrusted data via network connections, the rule is applicable.

Bibliography

[OWASP 2005]	A Guide to Building Secure Web Applications and Web Services
[OWASP 2007]	OWASP Top 10 for Java EE
[Seacord 2015]	Image Modified IDS00-J. Prevent SQL Injection LiveLesson
[W3C 2008]	Section 4.4.3, "Included If Validating"

...

...

Image Modified