Query String Injection: Android Provider

ABSTRACT

構建含有用戶輸入的 SQLite 查詢指令會讓攻擊者能夠查看未經授權的記錄。

EXPLANATION

Query string injection 漏洞會在以下情況下發生：
1. 數據從一個不可信賴的數據源進入程序。



2. 數據用于動態地構造一個 SQLite 查詢字符串。



SQL 數據庫的 injection 攻擊和 SQLite 數據庫的 injection 攻擊之間存在重大差異。與 SQL injection 不同，SQLite string injection 允許惡意用戶查看未經授權記錄，但不允許用戶以任何方式更改數據庫的狀態。

例 1：以下代碼動態地構造并執行了一個 SQLite 查詢，該查詢可搜索與客戶和用戶指定產品類別相關聯的清單。用戶還可以指定對結果進行排序的列。假定在執行此代碼片段之前已正確驗證了程序和設置了 customerID 的值。

  ...
productCategory = this.getIntent().getExtras().getString("productCategory");
sortColumn = this.getIntent().getExtras().getString("sortColumn");
customerID = getAuthenticatedCustomerID(customerName, customerCredentials);
c = invoicesDB.query(Uri.parse(invoices), columns, "productCategory = '" + productCategory + "' and customerID = '" + customerID + "'", null, null, null, "'" + sortColumn + "'asc", null);
  ...

select * from invoices
where productCategory = 'Fax Machines'
and customerID = '12345678'
order by 'price' asc

select * from invoices
where productCategory = 'Fax Machines' or productCategory = "'
and customerID = '12345678'
order by '" order by 'price' asc

select * from invoices
where productCategory = 'Fax Machines'
or productCategory = "' and customerID = '12345678' order by '"
order by 'price' asc

REFERENCES

[1] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A1 Injection

[2] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A2 Injection Flaws

[3] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A6 Injection Flaws

[4] Android Developers-Reference:SQLite Database

[5] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II

[6] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II

[7] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 89

[8] Standards Mapping - SANS Top 25 2009 - (SANS 2009) Insecure Interaction - CWE ID 089

[9] Standards Mapping - SANS Top 25 2010 - (SANS 2010) Insecure Interaction - CWE ID 089

[10] Standards Mapping - SANS Top 25 2011 - (SANS Top 25 2011) Insecure Interaction - CWE ID 089

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.3.1.1, Requirement 6.5.2

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.1

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 6.5.6

[14] Standards Mapping - FIPS200 - (FISMA) SI

[15] SQL as Understood by SQLite

[16] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) SQL Injection