Query String Injection: Android Provider

ABSTRACT

構建含有用戶輸入的 SQLite 查詢指令會讓攻擊者能夠查看未經授權的記錄。

EXPLANATION

Query string injection 漏洞會在以下情況下發生：
1. 數據從一個不可信賴的數據源進入程序。



2. 數據用于動態地構造一個 SQLite 查詢字符串。



SQL 數據庫的 injection 攻擊和 SQLite 數據庫的 injection 攻擊之間存在重大差異。與 SQL injection 不同，SQLite string injection 允許惡意用戶查看未經授權記錄，但不允許用戶以任何方式更改數據庫的狀態。

例 1：以下代碼動態地構造并執行了一個 SQLite 查詢，該查詢可搜索與客戶和用戶指定產品類別相關聯的清單。用戶還可以指定對結果進行排序的列。假定在執行此代碼片段之前已正確驗證了程序和設置了 customerID 的值。

  ...
productCategory = this.getIntent().getExtras().getString("productCategory");
sortColumn = this.getIntent().getExtras().getString("sortColumn");
customerID = getAuthenticatedCustomerID(customerName, customerCredentials);
c = invoicesDB.query(Uri.parse(invoices), columns, "productCategory = '" + productCategory + "' and customerID = '" + customerID + "'", null, null, null, "'" + sortColumn + "'asc", null);
  ...

這一代碼所執行的查詢如下所示：

select * from invoices
where productCategory = 'Fax Machines'
and customerID = '12345678'
order by 'price' asc

但是，這個查詢是動態構造的，由一個常數基查詢字符串和一個用戶輸入字符串 productCategory 連在一起形成。因此只有在 productCategory 與 sortColumn 不包含單引號字符時，這一查詢才能正確執行。如果攻擊者為 productCategory 提供了字符串 "Fax Machines' or productCategory = \""，并為 sortColumn 提供了字符串 "\" order by 'price"，則查詢將變為如下所示：

select * from invoices
where productCategory = 'Fax Machines' or productCategory = "'
and customerID = '12345678'
order by '" order by 'price' asc

或者采用以下可讀性更好的形式：

select * from invoices
where productCategory = 'Fax Machines'
or productCategory = "' and customerID = '12345678' order by '"
order by 'price' asc

這些輸入使攻擊者能繞過 customerID 所要求的 authentication，并查看與 'Fax Machines' 相匹配的所有客戶清單記錄。

REFERENCES

[1] Standards Mapping - OWASP Top 10 2010 - (OWASP 2010) A1 Injection

[2] Standards Mapping - OWASP Top 10 2007 - (OWASP 2007) A2 Injection Flaws

[3] Standards Mapping - OWASP Top 10 2004 - (OWASP 2004) A6 Injection Flaws

[4] Android Developers-Reference:SQLite Database

[5] Standards Mapping - Security Technical Implementation Guide Version 3 - (STIG 3) APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II

[6] Standards Mapping - Security Technical Implementation Guide Version 3.4 - (STIG 3.4) APP3510 CAT I, APP3540.1 CAT I, APP3540.3 CAT II

[7] Standards Mapping - Common Weakness Enumeration - (CWE) CWE ID 89

[8] Standards Mapping - SANS Top 25 2009 - (SANS 2009) Insecure Interaction - CWE ID 089

[9] Standards Mapping - SANS Top 25 2010 - (SANS 2010) Insecure Interaction - CWE ID 089

[10] Standards Mapping - SANS Top 25 2011 - (SANS Top 25 2011) Insecure Interaction - CWE ID 089

[11] Standards Mapping - Payment Card Industry Data Security Standard Version 1.2 - (PCI 1.2) Requirement 6.3.1.1, Requirement 6.5.2

[12] Standards Mapping - Payment Card Industry Data Security Standard Version 2.0 - (PCI 2.0) Requirement 6.5.1

[13] Standards Mapping - Payment Card Industry Data Security Standard Version 1.1 - (PCI 1.1) Requirement 6.5.6

[14] Standards Mapping - FIPS200 - (FISMA) SI

[15] SQL as Understood by SQLite

[16] Standards Mapping - Web Application Security Consortium 24 + 2 - (WASC 24 + 2) SQL Injection

97av