An attacker uses standard SQL injection methods to inject data into the command line for execution. This could be done directly through misuse of directives such as MSSQL_xp_cmdshell or indirectly through injection of data into the database that would be interpreted as shell commands. Sometime later, an unscrupulous backend application (or could be part of the functionality of the same application) fetches the injected data stored in the database and uses this data as command line arguments without performing proper validation. The malicious data escapes that data plane by spawning new commands to be executed on the host.
Description
Attack Execution Flow
4
1
Step 1
Explore[Probe for SQL Injection vulnerability] The attacker injects SQL syntax into user-controllable data inputs to search unfiltered execution of the SQL syntax in a query.
AI Translation
[Indaga sulla vulnerabilità di SQL Injection] L'attaccante inserisce sintassi SQL in input di dati controllabili dall'utente per cercare un'esecuzione non filtrata della sintassi SQL in una query.
2
Step 2
Exploit[Achieve arbitrary command execution through SQL Injection with the MSSQL_xp_cmdshell directive] The attacker leverages a SQL Injection attack to inject shell code to be executed by leveraging the xp_cmdshell directive.
AI Translation
[Ottieni l'esecuzione arbitraria di comandi tramite SQL Injection con la direttiva MSSQL_xp_cmdshell] L'attaccante sfrutta un attacco di SQL Injection per iniettare codice shell da eseguire, utilizzando la direttiva xp_cmdshell.
3
Step 3
Exploit[Inject malicious data in the database] Leverage SQL injection to inject data in the database that could later be used to achieve command injection if ever used as a command line argument
AI Translation
[Inserire dati dannosi nel database] Sfruttare SQL injection per inserire dati nel database che in seguito potrebbero essere utilizzati per ottenere command injection se mai usati come argomento da riga di comando
4
Step 4
Exploit[Trigger command line execution with injected arguments] The attacker causes execution of command line functionality which leverages previously injected database content as arguments.
AI Translation
[Trigger command line execution with injected arguments] L'attaccante provoca l'esecuzione di funzionalità della riga di comando che sfruttano contenuti del database precedentemente iniettati come argomenti.
Mitigations
3
Disable Mssql Xp_Cmdshell Directive On The Database
Do Not Implicitly Trust The Data Stored In The Database. Re-Validate It Prior To Usage To Make Sure That It Is Safe To Use In A Given Context (E.G. As A Command Line Argument).
Properly Validate The Data (Syntactically And Semantically) Before Writing It To The Database.
Consequences
Security Scopes Affected
Access Control
Authorization
Availability
Confidentiality
Integrity
Potential Impacts
Execute Unauthorized Commands
Gain Privileges
Modify Data
Read Data
Unreliable Execution
Relationships
Parent CAPECs
Resources Required
1
None: No specialized resources are required to execute this type of attack.