MM148635 (Community Member) asked a question.
'SQL Injection (CWE ID 89)
Application(.Net) using "CommanText" as a variable and stored proc name will be passed during runtime to the "CommanText" from the caller.Also Using parameterized query .But Veracode reports this as an issue
Application(.Net) using "CommanText" as a variable and stored proc name will be passed during runtime to the "CommanText" from the caller.Also Using parameterized query .But Veracode reports this as an issue
If we put sp name directly to the variable "commandtext", the flaw will be re-mediated.But it cannot be done since depending on the caller function, sp name will vary. How can we overcome this ? Please help.
.png){kind=logo}
Hi @MM148635 (Community Member) ,
Veracode Static Analysis will report a flaw of CWE 89 if we can detect that data in the command being executed is (partly) coming from a source of external data (like from a HTTP Request, but also from a file read, database read, webservice call, etc).
The concern being that an attacker may be able to use this external data to change the command that is to be run.
The only remediation that Veracode Static Analysis automatically detects is to ensure no external data will ever be in the command that is to be sent.
You can do this by for example changing:
string requestTable = Request.QueryString["table"];
command.CommandText = "SELECT * FROM " + requestTable;
command.Prepare();
command.ExecuteNonQuery();
To:
command.CommandText = "SELECT * FROM user";
command.Prepare();
command.ExecuteNonQuery();
Or:
if (Request.QueryString["table"].Equals("users")) {
command.CommandText = "SELECT * FROM users";
} else {
command.CommandText = "SELECT * FROM employees";
}
command.Prepare();
command.ExecuteNonQuery();
If you cannot remove dynamic data from the query as you need more dynamic validation (for example with a regex) this will not be automatically detectable by Veracode Static Analysis and you will need to implement your validation, rescan, propose a mitigation ( https://help.veracode.com/reader/DGHxSJy3Gn3gtuSIN2jkRQ/~p4MSKOS8F8X8h0KwFTKoQ ) and request approval from your security team.
If you have any other questions, I would recommend you schedule a consultation call to discuss.
You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Thank you,
Boy Baukema