CSurendran171876 (Community Member) asked a question.
Need help in CWE15 and CWE 89
- For Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') CWE ID 89 - the Recommendations are Avoid dynamically constructing SQL queries. But in some cases we need to use string.format(Select * from table1_{0},someid) as we need it to construct this in inline queries of C# side, Could you help to know how can we mitigate this type of code?
- Untrusted Initialization - External Control of System or Configuration Setting (CWE ID 15) - We need to construct connectionstring based on on some parameter like - Since the connection is based on parameter in c# side we need retrieve the connection name from config file based on that parameter. But the vulnerabilities are showing in the line -new SqlDatabase(l_ConnectionString) - Please help how we can solve this issue.
Thanks.
.png){kind=logo}
CWE89
As you have found out, the usage of parameterized prepared statements is not possible for table names. The recommendation is to not allow dynamic table names from an untrusted source. If this is not possible, you may have to implement a regex that evaluates the table name conforms to the format for your table names. Additionally, make sure there is appropriate authorization/authentication checks to ensure the user is accessing only their own data.
CWE15
If this is data coming from a config file, you are partially safe. The scan for CWE15 is concerned about two things...
Your first point indicates you are retrieving the information from a trusted source. I would additionally evaluate who has access to the config file(contractors, developers, etc..) The principle of least privilege is very important here. You want to make sure only the appropriate team members only have access to make such changes.
The second point is to make sure you are encrypting any sensitive credentials at rest. Plaintext storage of credentials is a security issue.