CAPEC-109: Object Relational Mapping Injection

Object Relational Mapping Injection

状态:Draft

Typical_Severify: High

攻击可能性:Low

描述

An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject his or her own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.

相关攻击模式

ChildOf: CAPEC-66 |SQL Injection

Execution Flow Attack Setp

Setp 1 Explore

[Determine Persistence Framework Used] An attacker tries to determine what persistence framework is used by the application in order to leverage a weakness in the generated data access layer code or a weakness in a way that the data access layer may have been used by the developer.

Setp 2 Explore

[Probe for ORM Injection vulnerabilities] The attacker injects ORM syntax into user-controllable data inputs of the application to determine if it is possible modify data query structure and content.

Setp 3 Exploit

[Perform SQL Injection through the generated data access layer] An attacker proceeds to exploit a weakness in the generated data access methods that does not properly separate control plane from the data plan, or potentially a particular way in which developer might have misused the generated code, to modify the structure of the executed SQL queries and/or inject entirely new SQL queries.

前置条件

An application uses data access layer generated by an ORM tool or framework

An application uses user supplied data in queries executed against the database

The separation between data plane and control plane is not ensured, through either developer error or an underlying weakness in the data access layer code generation framework

所需技能

Level Medium

Knowledge of general SQL injection techniques and subtleties of the ORM framework is needed

所需资源

None: No specialized resources are required to execute this type of attack.

后果

Scope Impact Likelihood
I n t e g r i t y Modify Data
A v a i l a b i l i t y Unreliable Execution
C o n f i d e n t i a l i t y Read Data
Confidentiality Access Control Authorization Gain Privileges
Confidentiality Integrity Availability Execute Unauthorized Commands

缓解措施

Remember to understand how to use the data access methods generated by the ORM tool / framework properly in a way that would leverage the built-in security mechanisms of the framework

Ensure to keep up to date with security relevant updates to the persistence framework used within your application.

实例

When using Hibernate, it is possible to use the session.find() method to run queries against the database. This is an overloaded method that provides facilities to perform binding between the supplied user data and place holders in the statically defined query. However, it is also possible to use the session.find() method without using any of these query binding overloads, hence effectively concatenating the user supplied data with rest of the SQL query, resulting in a possibility for SQL injection. While the framework may provide mechanisms to use methods immune to SQL injections, it may also contain ways that are not immune that may be chosen by the developer.

相关CWE

20 | 输入验证不恰当

100 | 特定技术的输入验证问题

89 | SQL命令中使用的特殊元素转义处理不恰当(SQL注入)

564 | SQL注入:Hibernate

内容历史记录

提交

2014-06-23 | CAPEC Content Team | The MITRE Corporation

修改

2017-08-04 | CAPEC Content Team | The MITRE Corporation

Updated Resources_Required