Why was this Dynamic Scan flaw flagged as CWE 89?

stevew611125 (Community Member) asked a question.

November 10, 2021 at 3:39 PM

The request/response tab has the following request (URL anonymized). The bold portions are what are highlighted in yellow which I believe means that's why the scan engine flagged it as CWE 89.

GET /Some/Path?q1=&q2=

1 HTTP/1.1

...

Note that the newline before the 1 is in the request tab.

And response body (partial):

...

{"data":[{"DateCreated":"\/Date( 1 597326008083)\/"

...

Note the spaces around the 1.

I don't think the JSON serializer actually put spaces around the 1, I think it's just a display artifact of the flaw request/response tab. Is this some display error with the request/response tab or did it actually attempt to include a newline in the request? Any ideas why was this flagged as SQL Injection flaw?

Florian, Security Consultant (Veracode)
5 years ago
Hi @stevew611125 (Community Member),

From this information, I am unable to detect what is reported here. If the flaw description does not provide you with sufficient information, I would recommend navigating to the "Triage Flaws" view of the particular scan in the Veracode platform. Next, please select the particular CWE 89 finding, and click on "Download Flaw Details".

This downloads a big JSON which, when displayed in a JSON beautifier, should provide some more details with respect to "reasons" and injected "payloads". As a consultant, I would usually look at this JSON to get more information myself in preparation for a consultation. I hope that helps.

This might provide you with enough information to triage this finding. However, please also feel free to schedule a consultation if you need some additional assistance. The following knowledge article describes how to do this: https://community.veracode.com/s/article/How-to-schedule-a-consultation-call

Thank you,
Florian Walter
Expand Post