An attacker modifies the parameters of the SOAP message that is sent from the service consumer to the service provider to initiate a SQL injection attack. On the service provider side, the SOAP message is parsed and parameters are not properly validated before being used to access a database in a way that does not use parameter binding, thus enabling the attacker to control the structure of the executed SQL query. This pattern describes a SQL injection attack with the delivery mechanism being a SOAP message.
Description
Attack Execution Flow
3
1
Step 1
Explore[Detect Incorrect SOAP Parameter Handling] The attacker tampers with the SOAP message parameters and looks for indications that the tampering caused a change in behavior of the targeted application.
The attacker tampers with the SOAP message parameters by injecting some special characters such as single quotes, double quotes, semi columns, etc. The attacker observes system behavior.
AI Translation
[Individuare Gestione Errata dei Parametri SOAP] L'attaccante manipola i parametri del messaggio SOAP e cerca indicazioni che la manomissione abbia causato un cambiamento nel comportamento dell'applicazione target.
L'attaccante manipola i parametri del messaggio SOAP inserendo caratteri speciali come virgolette singole, virgolette doppie, punto e virgola, ecc. L'attaccante osserva il comportamento del sistema.
Attack Techniques
-
The attacker tampers with the SOAP message parameters by injecting some special characters such as single quotes, double quotes, semi columns, etc. The attacker observes system behavior.
2
Step 2
Experiment[Probe for SQL Injection vulnerability] The attacker injects SQL syntax into vulnerable SOAP parameters identified during the Explore phase to search for unfiltered execution of the SQL syntax in a query.
AI Translation
[Indagine sulla vulnerabilità di SQL Injection] L'attaccante inserisce sintassi SQL nei parametri SOAP vulnerabili identificati durante la fase di Esplorazione per cercare un'esecuzione non filtrata della sintassi SQL in una query.
3
Step 3
Exploit[Inject SQL via SOAP Parameters] The attacker injects SQL via SOAP parameters identified as vulnerable during Explore phase to launch a first or second order SQL injection attack.
An attacker performs a SQL injection attack via the usual methods leveraging SOAP parameters as the injection vector. An attacker has to be careful not to break the XML parser at the service provider which may prevent the payload getting through to the SQL query. The attacker may also look at the WSDL for the web service (if available) to better understand what is expected by the service provider.
AI Translation
[Inject SQL via Parameters SOAP] L'attaccante inietta SQL tramite parametri SOAP identificati come vulnerabili durante la fase di Esplorazione per avviare un attacco di SQL injection di prima o seconda generazione.
Un attaccante esegue un attacco di SQL injection tramite i metodi abituali sfruttando i parametri SOAP come vettore di iniezione. L'attaccante deve fare attenzione a non interrompere il parser XML del fornitore del servizio, il che potrebbe impedire che il payload raggiunga la query SQL. L'attaccante può anche esaminare il WSDL del web service (se disponibile) per comprendere meglio cosa ci si aspetta dal fornitore del servizio.
Attack Techniques
-
An attacker performs a SQL injection attack via the usual methods leveraging SOAP parameters as the injection vector. An attacker has to be careful not to break the XML parser at the service provider which may prevent the payload getting through to the SQL query. The attacker may also look at the WSDL for the web service (if available) to better understand what is expected by the service provider.
Mitigations
3
At The Database Level, Ensure That The Database User Used By The Application In A Particular Context Has The Minimum Needed Privileges To The Database That Are Needed To Perform The Operation. When Possible, Run Queries Against Pre-Generated Views Rather Than The Tables Directly.
Ensure That Prepared Statements Or Other Mechanism That Enables Parameter Binding Is Used When Accessing The Database In A Way That Would Prevent The Attackers' Supplied Data From Controlling The Structure Of The Executed Query.
Properly Validate And Sanitize/Reject User Input At The Service Provider.
Consequences
Security Scopes Affected
Access Control
Authorization
Availability
Confidentiality
Integrity
Potential Impacts
Execute Unauthorized Commands
Gain Privileges
Modify Data
Read Data
Unreliable Execution
Relationships
Parent CAPECs
Resources Required
1
None: No specialized resources are required to execute this type of attack.