Hi @FAlvarez Jasso770844 (Community Member)​ ,

Veracode Static Analysis reports a flaw of CWE 15 if it can detect that data from an external source is used in a connection string.

The danger is that an attacker may inject their own options into the connection string used (see for example https://security.stackexchange.com/a/178791/3206 ).

I would recommend you do the following:

1. Review your module configuration by opening the Veracode Platform ( https://analysiscenter.veracode.com ) and going to Review Modules for this scan (you can do so in the Veracode Platform by going the the report then in the menu on the left hand side clicking "Static Scan" (will typically be something like "Static Scan <NAME OF SCAN>". This then opens a submenu in that same menu with "Review Modules". Then ensuring that you have not selected libraries as an entry point as this is likely not a true entry point for your application (something users interact with) and we will treat any input from a public method of that entry point as possibly attacker controlled. You can read more on what modules are and how they impact your results here: https://community.veracode.com/s/article/What-are-Modules-and-how-do-my-results-change-based-on-what-I-select .
2. Ensuring you are using a Connection String Builder if you are dynamically creating the connection string, for more information see: https://docs.microsoft.com/en-us/dotnet/framework/data/adonet/connection-string-builders .
3. Investigating if you should encrypt the connection string: https://docs.microsoft.com/en-us/previous-versions/ms178372(v=vs.140)
4. Reviewing any dynamic data in the connection string and replacing it, if possible, by a hardcoded value.
5. If not possible, ensuring you have validation in place for the dynamic data and proposing a mitigation documenting this validation, you can find more information on how to do so here: https://help.veracode.com/r/improve_mitigation . Mitigation proposals must be reviewed by a member of your organizations security team.

While using a ConnectionStringBuilder and encrypting the connection string are excellent controls, they cannot be automatically detected by Veracode Static Analysis.

As long as you have dynamic data in your connection string Veracode Static Analysis will not automatically close this flaw, however this does not mean that you are vulnerable to injection.

If you have adequate controls in place please document them in a mitigation proposal ( more info here: https://help.veracode.com/r/improve_mitigation ) and have this manually reviewed by your security team.

Thank you,

Boy Baukema