Query String Injection: Amazon Web Services

Constructing a SimpleDB select statement that contains user input can allow an attacker to view unauthorized records.

Query string injection vulnerabilities occur when:
1. Data enters a program from an untrusted source.



2. The data is used to dynamically construct a SimpleDB query string.

Example 1: The following code dynamically constructs and executes a SimpleDB select() query that searches for invoices that match a user-specified product category. The user can also specify the column by which the results are sorted. Assume that the application has already properly authenticated and set the value of customerID prior to this code segment.

...
String customerID = getAuthenticatedCustomerID(customerName, customerCredentials);
...
AmazonSimpleDBClient sdbc = new AmazonSimpleDBClient(appAWSCredentials);
String query = "select * from invoices where productCategory = '"
            + productCategory + "' and customerID = '"
            + customerID + "' order by '"
            + sortColumn + "' asc";
SelectResult sdbResult = sdbc.select(new SelectRequest(query));
...

The query that this code intends to execute looks like:

select * from invoices
where productCategory = 'Fax Machines'
and customerID = '12345678'
order by 'price' asc

However, because the query is constructed dynamically by concatenating a constant base query string and a user input string, the query only behaves correctly if productCategory and price do not contain single-quote characters. If, however, an attacker provides the string "Fax Machines' or productCategory = \"" for productCategory, and the string "\" order by 'price" for sortColumn, then the query becomes the following:

select * from invoices
where productCategory = 'Fax Machines' or productCategory = "'
and customerID = '12345678'
order by '" order by 'price' asc

or, in a more human-readable form,

select * from invoices
where productCategory = 'Fax Machines'
or productCategory = "' and customerID = '12345678' order by '"
order by 'price' asc

These inputs allow an attacker to bypass the required authentication for customerID, and allows the attacker to view invoice records matching 'Fax Machines' for all customers.