• Boy, Security Consultant (Veracode)

    Hi @LReddy078094 (Community Member)​ ,

     

    Veracode Static Analysis reports a flaw of CWE 15 if it can detect that data from an external source is used in a connection string.

    The danger is that an attacker may inject their own options into the connection string used (see for example https://security.stackexchange.com/a/178791/3206 ).

     

    I would recommend you do the following:

    1. Review your module configuration by opening the Veracode Platform ( https://analysiscenter.veracode.com ) and going to Review Modules for this scan (you can do so in the Veracode Platform by going the the report then in the menu on the left hand side clicking "Static Scan" (will typically be something like "Static Scan <NAME OF SCAN>". This then opens a submenu in that same menu with "Review Modules". Then ensuring that you have not selected libraries as an entry point as this is likely not a true entry point for your application (something users interact with) and we will treat any input from a public method of that entry point as possibly attacker controlled.
    2. Ensuring you are using a Connection String Builder if you are dynamically creating the connection string, for more information see: https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/connection-string-builders .
    3. Investigating if you should encrypt the connection string: https://docs.microsoft.com/en-us/previous-versions/ms178372(v=vs.140)
    4. Reviewing any dynamic data in the connection string and replacing it, if possible, by a hardcoded value.
    5. If not possible, ensuring you have validation in place for the dynamic data and proposing a mitigation documenting this validation, you can find more information on how to do so here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ . Mitigation proposals must be reviewed by a member of your organizations security team.

     

    Please let me know if you have any remaining questions or concerns.

     

    Thank you,

    Boy Baukema

    Expand Post

  • LReddy078094 (Community Member)

    Hello Boy,

     

    Thank you for providing the explanation on CWE 15. I did go through the links provided, it was helpful. I cleared most of the flaws but one of them seems to be troubling me still.

     

    I corrected my code to use OleDBConnection Builder, but doesn’t help. Still getting the same error except that the score percentage increased from 61 to 74%. (Not sure what that score implies here though)

     

    Here is the code it is failing. What else do you think I need to do. Please help

     

    Code1

     

    Thanks,

    Lavan

    Expand Post

    • Boy, Security Consultant (Veracode)

      Hi Lavan,

       

      As soon as Veracode Static Analysis detects *any* dynamic data from outside of the application it will report a flaw of CWE 15. In this example this may be the 'file' variable.

      It will highlight that if the file is attacker controlled they may use that to select any file available to the application.

       

      I would recommend reviewing whether it's possible to make the file value hardcoded (possibly with an if condition checking which hardcoded value to use).

      If not possible, ensuring you have validation in place (for example ensuring that only files from a given directory may be selected) and proposing a mitigation documenting this validation, you can find more information on how to do so here: https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ . Mitigation proposals must be reviewed by a member of your organizations security team.

       

      Please note that if you see percentage signs in your results instead of line numbers this is typically an indication you are not providing us with the PDB files so we are unable to give you a specific line number. If this is the case I would recommend reviewing our compilation guide ( https://help.veracode.com/reader/4EKhlLSMHm5jC8P8j3XccQ/UWyzuOKNbFbwQACRLkZVjA ) and ensuring the build you provide to us has been compiled with PDB files.

       

      Please let me know if you have any remaining questions or concerns.

       

      Thank you,

      Boy Baukema

      Expand Post

Topics (4)

No articles found
Loading

Ask the Community

Get answers, share a use case, discuss your favorite features, or get input from the community.