1.Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'): Veracode injected the SQL query in “Cache-Control” header parameter and says server response was slow downed and recommendation is mentioning about normal SQL Injection related only. Not sure what is the relation here for SQL Injection with “Cache-Control” parameter and how the queries get executed in the “cache-control” parameter. Any thoughts on this?

Veracode Details:

Description

By injecting invalid SQL queries or commands such as '||(select(count(*))from(system.help),system.help,system.help)||' into the Cache-Control parameter, the application was observed to respond slower to

custom attacks meant to cause execution of SQL queries to be delayed for a measurable amount of time. This is a form of time based SQL Injection, where an attacker injects a query that takes a long period of time

to complete to infer whether the target inputs are vulnerable.

Recommendations

Avoid dynamically constructing SQL queries. Instead, use parameterized prepared statements to prevent the database from interpreting the contents of bind variables as part of the query.

2.Cross-Site Request Forgery (CSRF): The “SameSite” cookie attribute seems to be newly introduced by Chrome. Is it the “same site” means “Host+Context-Root” or just the “host” since multiple apps can be deployed on the same host and if it is “host+Context-root”, the Strict / Lax options may cause problems as the ‘JSESSIONID’ will not be forwarded along with the request for the “Strict” option and it will be passed for “GET” request only for the “Lax” option. Any thought son this where we can apply to test if the cookies are not programmatically created (JSESSIONID / DWRSESSIONID) and is it can be ignored if the “Referrer Header Check” option is in place?

Veracode Details:

Recommendations:

session cookies should be protected with the SameSite attribute set to either Strict or Lax.

3.Protection Mechanism Failure: Are there any issues if we implement “SAMEORIGIN” option for the header “X-Frame-Options” with respect to other app integrations like Cloud Foundry UAA, REST services etc., which are deployed on different servers?

Thanks,

Purushotham