Poisoned Pipeline / Techniques / T0117
SQL injection
SQL injection is a web security vulnerability that allows an attacker to interfere with the queries that an application makes to its database.
A SQL injection attack consists of insertion or "injection" of a SQL query via the input data from the client to the application.
Successful SQL injection exploit can read sensitive data from the database, modify database data (Insert/Update/Delete), execute administration operations on the database (such as shutdown the DBMS), recover the content of a given file present on the DBMS file system and in some cases issue commands to the operating system.
Where this idea came from
Recorded from defender guidance (OWASP, NIST, SLSA, CISA, or vendor secure-development docs) as an attacker-side behavior.
- https://www.spiceworks.com/it-security/application-security/articles/what-is-sql-injection/
- https://owasp.org/www-community/attacks/SQL_Injection
- https://portswigger.net/web-security/sql-injection
Mitigations
- M1170 Use parameterized queries
- M1171 Use stored procedures
- M1172 Use allow-list input validation
- M1173 Escape all user supplied input
- M1883 Implement Web Application Firewall
Detections
- D1170 Configure application audit logs to detect injection attacks
- D1171 Implement Web Application Firewall