Skip to main content

SQL Injection - Headers

Need​

Prevention of SQL injection in the idClient header and application fields

Context​

  • Usage of C# for developing robust and efficient software applications
  • Usage of Microsoft.AspNetCore.Mvc for building web applications with ASP.NET Core
  • Usage of Microsoft.EntityFrameworkCore for working with databases in .NET applications

Description​

Non compliant code​

[HttpPost]
public async Task<IActionResult> GetClientDetails()
{
    var idClient = Request.Headers["idClient"].ToString();
    var client = await _context.Clients.FromSqlRaw("SELECT * FROM Clients WHERE Id = " + idClient).ToListAsync();
    return Ok(client);
}

In the above code, we have a POST method GetClientDetails() which fetches client details from the database. The method retrieves the idClient from the request headers and uses this idClient directly in the SQL query.

This is vulnerable to SQL Injection because the idClient is directly concatenated into the SQL query without any sanitization or parameterization. If an attacker modifies the idClient header to contain SQL code, they can manipulate the query to return unauthorized data, delete data, or execute other malicious SQL commands.

For example, if an attacker sets idClient to 1 OR 1=1, the resulting SQL query would be SELECT * FROM Clients WHERE Id = 1 OR 1=1, which would return all clients, not just the one with Id = 1.

This is a serious security flaw as it provides a potential attacker with the ability to execute arbitrary SQL commands on the database through the application.

Steps​

  • Use parameterized queries or prepared statements to prevent SQL injection.
  • Validate and sanitize user input before using it in SQL queries.
  • Use built-in ORM (Object-Relational Mapping) frameworks or libraries to handle database operations.
  • Implement proper input validation and data validation techniques to ensure the data is of the expected format and type.
  • Implement a whitelist approach for input validation, allowing only specific characters or patterns.
  • Implement proper authentication and authorization mechanisms to prevent unauthorized access to sensitive data.
  • Regularly update and patch the application and its dependencies to fix any known security vulnerabilities.
  • Conduct regular security audits and penetration testing to identify and address any potential vulnerabilities.

Compliant code​

[HttpPost]
public async Task<IActionResult> GetClientDetails()
{
    var idClient = Request.Headers["idClient"].ToString();
    var client = await _context.Clients.FromSqlInterpolated($"SELECT * FROM Clients WHERE Id = {idClient}").ToListAsync();
    return Ok(client);
}

The original code was vulnerable to SQL Injection attacks because it directly concatenated a value from the HTTP headers into a SQL query. This means that an attacker could potentially manipulate the idClient header to execute arbitrary SQL commands.

The fixed code uses parameterized queries to prevent SQL Injection. The FromSqlInterpolated method in Entity Framework Core is used to create a parameterized query. This method replaces {idClient} with a parameter in the generated SQL query, and any necessary SQL escaping is done automatically.

This way, even if an attacker tries to inject SQL commands into the idClient header, they will be treated as a string literal in the SQL query and will not be executed as SQL commands.

In addition to this, it's recommended to implement proper input validation and sanitization techniques to ensure that the idClient header contains only valid client IDs. This could include checking that the idClient is a valid integer, and rejecting any requests where it's not.

Regular security audits and updates should also be conducted to ensure that the application and its dependencies are free from known security vulnerabilities.

References​

Last updated on