界: Input Validation and Representation
輸入驗證和表示法問題是由中繼字元、替代編碼和數值表示法引起的。信任輸入會導致安全問題。問題包括:「Buffer Overflows」、「Cross-Site Scripting」攻擊、「SQL Injection」及其他許多問題。
SQL Injection: Poor Validation
Abstract
依賴 HTML、XML 和其他類型的編碼來驗證不可信賴的輸入,可能會讓攻擊者修改陳述式的意義或是執行任意 SQL 指令。
Explanation
使用編碼函數 (例如
SQL Injection 錯誤會在以下情況中出現:
1. 資料從一個不可信賴的來源進入程式。
2. 資料用來動態建構 SQL 查詢。
範例 1: 以下範例示範資料庫的配置如何修改
如果攻擊者將
由於
避免 SQL injection 攻擊的一個傳統方法為,將其視為輸入驗證的問題,只接受安全值允許清單中的字元,或是驗證並避免來自潛在惡意值的清單 (拒絕清單)。檢查允許清單是一種相當有效的方法,可強制執行嚴格的輸入驗證規則,而參數化 SQL 陳述式所需的維護較少,並且能提供更高的安全性保障。通常,實作拒絕清單總是存在一些漏洞,所以無法有效避免 SQL injection 攻擊。例如,攻擊者可能:
- 將未列入黑名單的值當作目標
- 尋找方法以略過特定逸出中繼字元 (escape meta-character) 的需要
- 使用儲存的程序去隱藏插入的中繼字元
手動在 SQL 查詢中避開特殊字元的輸入有一定作用,但無法完全保護您的應用程式免於 SQL injection 攻擊。
另外一個處理 SQL injection 攻擊的普遍建議方法為使用儲存的程序。 雖然儲存的程序可避免某些類型的 SQL injection 攻擊,但是對於大多數的攻擊還是無能為力。 儲存的程序一般用來避免 SQL injection 攻擊的方式是,限制可以傳送到參數的陳述式類型。 但是,雖然有許多的限制方法,仍有許多危險的陳述式可以傳入儲存的程序中。 所以再次強調,儲存的程序可以避免部分攻擊,但是並不能完全協助您的應用系統抵禦 SQL injection 的攻擊。
mysql_real_escape_string()
) 可阻止部分,但不是所有 SQL injection 弱點。依賴此類編碼函數等同於使用安全性較差的拒絕清單來防止 SQL injection,可能會讓攻擊者修改陳述式的意義或是執行任意 SQL 指令。由於並非隨時都可以靜態確定輸入將在動態解譯程式碼指定段落中的何處顯示,Fortify Secure Coding Rulepacks 可能會將已驗證的動態 SQL 資料呈現為「SQL Injection: Poor Validation」問題,即便驗證足以阻止當前內容中的 SQL Injection 也是如此。SQL Injection 錯誤會在以下情況中出現:
1. 資料從一個不可信賴的來源進入程式。
2. 資料用來動態建構 SQL 查詢。
範例 1: 以下範例示範資料庫的配置如何修改
mysqli_real_escape_string()
的行為。 SQL 模式設為「NO_BACKSLASH_ESCAPES」時,反斜線字元會被視為正常字元,而不是逸出字元[5]。 由於 mysqli_real_escape_string()
將此納入考量,所以以下查詢容易受到 SQL injection 攻擊,究其原因,是資料庫配置導致 "
不再逸出為 \"
。
mysqli_query($mysqli, 'SET SQL_MODE="NO_BACKSLASH_ESCAPES"');
...
$userName = mysqli_real_escape_string($mysqli, $_POST['userName']);
$pass = mysqli_real_escape_string($mysqli, $_POST['pass']);
$query = 'SELECT * FROM users WHERE userName="' . $userName . '"AND pass="' . $pass. '";';
$result = mysqli_query($mysqli, $query);
...
如果攻擊者將
password
欄位留白並針對 userName
輸入 " OR 1=1;--
,則引號不會逸出並產生如下查詢:
SELECT * FROM users
WHERE userName = ""
OR 1=1;
-- "AND pass="";
由於
OR 1=1
會使 where 子句的評估永遠為 True,且雙連字符號會使陳述式的其餘部分被視為註解,查詢便會從邏輯上等同於以下大為簡化的查詢:
SELECT * FROM users;
避免 SQL injection 攻擊的一個傳統方法為,將其視為輸入驗證的問題,只接受安全值允許清單中的字元,或是驗證並避免來自潛在惡意值的清單 (拒絕清單)。檢查允許清單是一種相當有效的方法,可強制執行嚴格的輸入驗證規則,而參數化 SQL 陳述式所需的維護較少,並且能提供更高的安全性保障。通常,實作拒絕清單總是存在一些漏洞,所以無法有效避免 SQL injection 攻擊。例如,攻擊者可能:
- 將未列入黑名單的值當作目標
- 尋找方法以略過特定逸出中繼字元 (escape meta-character) 的需要
- 使用儲存的程序去隱藏插入的中繼字元
手動在 SQL 查詢中避開特殊字元的輸入有一定作用,但無法完全保護您的應用程式免於 SQL injection 攻擊。
另外一個處理 SQL injection 攻擊的普遍建議方法為使用儲存的程序。 雖然儲存的程序可避免某些類型的 SQL injection 攻擊,但是對於大多數的攻擊還是無能為力。 儲存的程序一般用來避免 SQL injection 攻擊的方式是,限制可以傳送到參數的陳述式類型。 但是,雖然有許多的限制方法,仍有許多危險的陳述式可以傳入儲存的程序中。 所以再次強調,儲存的程序可以避免部分攻擊,但是並不能完全協助您的應用系統抵禦 SQL injection 的攻擊。
References
[1] S. J. Friedl SQL Injection Attacks by Example
[2] P. Litwin Stop SQL Injection Attacks Before They Stop You MSDN Magazine
[3] P. Finnigan SQL Injection and Oracle, Part One Security Focus
[4] M. Howard, D. LeBlanc Writing Secure Code, Second Edition Microsoft Press
[5] 5.1.8 Server SQL Modes MySQL
[6] Standards Mapping - CIS Azure Kubernetes Service Benchmark 5.0
[7] Standards Mapping - CIS Microsoft Azure Foundations Benchmark complete
[8] Standards Mapping - CIS Amazon Elastic Kubernetes Service Benchmark 4.0
[9] Standards Mapping - CIS Amazon Web Services Foundations Benchmark 1
[10] Standards Mapping - CIS Google Kubernetes Engine Benchmark integrity
[11] Standards Mapping - CIS Kubernetes Benchmark partial
[12] Standards Mapping - Common Weakness Enumeration CWE ID 89
[13] Standards Mapping - Common Weakness Enumeration Top 25 2019 [6] CWE ID 089
[14] Standards Mapping - Common Weakness Enumeration Top 25 2020 [6] CWE ID 089
[15] Standards Mapping - Common Weakness Enumeration Top 25 2021 [6] CWE ID 089
[16] Standards Mapping - Common Weakness Enumeration Top 25 2022 [3] CWE ID 089
[17] Standards Mapping - Common Weakness Enumeration Top 25 2023 [3] CWE ID 089
[18] Standards Mapping - DISA Control Correlation Identifier Version 2 CCI-001310, CCI-002754
[19] Standards Mapping - FIPS200 SI
[20] Standards Mapping - General Data Protection Regulation (GDPR) Indirect Access to Sensitive Data
[21] Standards Mapping - Motor Industry Software Reliability Association (MISRA) C Guidelines 2012 Rule 1.3
[22] Standards Mapping - NIST Special Publication 800-53 Revision 4 SI-10 Information Input Validation (P1)
[23] Standards Mapping - NIST Special Publication 800-53 Revision 5 SI-10 Information Input Validation
[24] Standards Mapping - OWASP Top 10 2004 A6 Injection Flaws
[25] Standards Mapping - OWASP Top 10 2007 A2 Injection Flaws
[26] Standards Mapping - OWASP Top 10 2010 A1 Injection
[27] Standards Mapping - OWASP Top 10 2013 A1 Injection
[28] Standards Mapping - OWASP Top 10 2017 A1 Injection
[29] Standards Mapping - OWASP Top 10 2021 A03 Injection
[30] Standards Mapping - OWASP Application Security Verification Standard 4.0 5.3.4 Output Encoding and Injection Prevention Requirements (L1 L2 L3), 5.3.5 Output Encoding and Injection Prevention Requirements (L1 L2 L3)
[31] Standards Mapping - OWASP Mobile 2014 M7 Client Side Injection
[32] Standards Mapping - OWASP Mobile Application Security Verification Standard 2.0 MASVS-CODE-4
[33] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 Requirement 6.5.6
[34] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 Requirement 6.3.1.1, Requirement 6.5.2
[35] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 Requirement 6.5.1
[36] Standards Mapping - Payment Card Industry Data Security Standard Version 3.0 Requirement 6.5.1
[37] Standards Mapping - Payment Card Industry Data Security Standard Version 3.1 Requirement 6.5.1
[38] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2 Requirement 6.5.1
[39] Standards Mapping - Payment Card Industry Data Security Standard Version 3.2.1 Requirement 6.5.1
[40] Standards Mapping - Payment Card Industry Data Security Standard Version 4.0 Requirement 6.2.4
[41] Standards Mapping - Payment Card Industry Software Security Framework 1.0 Control Objective 4.2 - Critical Asset Protection
[42] Standards Mapping - Payment Card Industry Software Security Framework 1.1 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation
[43] Standards Mapping - Payment Card Industry Software Security Framework 1.2 Control Objective 4.2 - Critical Asset Protection, Control Objective B.3.1 - Terminal Software Attack Mitigation, Control Objective B.3.1.1 - Terminal Software Attack Mitigation, Control Objective C.3.2 - Web Software Attack Mitigation
[44] Standards Mapping - SANS Top 25 2009 Insecure Interaction - CWE ID 089
[45] Standards Mapping - Security Technical Implementation Guide Version 3.1 APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[46] Standards Mapping - Security Technical Implementation Guide Version 3.4 APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[47] Standards Mapping - Security Technical Implementation Guide Version 3.5 APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[48] Standards Mapping - Security Technical Implementation Guide Version 3.6 APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[49] Standards Mapping - Security Technical Implementation Guide Version 3.7 APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[50] Standards Mapping - Security Technical Implementation Guide Version 3.9 APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[51] Standards Mapping - Security Technical Implementation Guide Version 3.10 APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II
[52] Standards Mapping - Security Technical Implementation Guide Version 4.1 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[53] Standards Mapping - Security Technical Implementation Guide Version 4.2 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[54] Standards Mapping - Security Technical Implementation Guide Version 4.3 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[55] Standards Mapping - Security Technical Implementation Guide Version 4.4 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[56] Standards Mapping - Security Technical Implementation Guide Version 4.5 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[57] Standards Mapping - Security Technical Implementation Guide Version 4.6 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[58] Standards Mapping - Security Technical Implementation Guide Version 4.7 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[59] Standards Mapping - Security Technical Implementation Guide Version 4.8 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[60] Standards Mapping - Security Technical Implementation Guide Version 4.9 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[61] Standards Mapping - Security Technical Implementation Guide Version 4.10 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[62] Standards Mapping - Security Technical Implementation Guide Version 4.11 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[63] Standards Mapping - Security Technical Implementation Guide Version 5.1 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[64] Standards Mapping - Security Technical Implementation Guide Version 5.2 APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[65] Standards Mapping - Security Technical Implementation Guide Version 5.3 APSC-DV-002530 CAT II, APSC-DV-002540 CAT I, APSC-DV-002560 CAT I
[66] Standards Mapping - Web Application Security Consortium Version 2.00 SQL Injection (WASC-19)
[67] Standards Mapping - Web Application Security Consortium 24 + 2 SQL Injection
desc.dataflow.php.sql_injection_poor_validation