Home > CAPEC List > CAPEC-109: Object Relational Mapping Injection (Version 2.4)  

CAPEC-109: Object Relational Mapping Injection

 
Object Relational Mapping Injection
Definition in a New Window Definition in a New Window
Attack Pattern ID: 109
Abstraction: Standard
Status: Draft
Completeness: Complete
+ Description

Summary

An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject his or her own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.

Attack Execution Flow

Explore
  1. Determine Persistence Framework Used:

    An attacker tries to determine what persistence framework is used by the application in order to leverage a weakness in the generated data access layer code or a weakness in a way that the data access layer may have been used by the developer.

    Attack Step Techniques

    IDAttack Step Technique DescriptionEnvironments
    1

    An attacker provides input to the application in an attempt to induce an error screen that reveals a stack trace that gives an indication of the automated data access layer used. Or an attacker may simply make some educated guesses and assume, for instance, that Hibernate is used and try to craft an attack from there.

    env-Web
  2. Probe for ORM Injection vulnerabilities:

    The attacker injects ORM syntax into user-controllable data inputs of the application to determine if it is possible modify data query structure and content.

    Indicators

    IDTypeIndicator DescriptionEnvironments
    1Negative

    Attacker receives normal response from server.

    env-Web env-ClientServer env-Peer2Peer env-CommProtocol
    2Positive

    Attacker receives an error message from server indicating that there was a problem with the data query.

    env-Web env-ClientServer env-Peer2Peer env-CommProtocol
    3Negative

    Server sends a specific error message that indicates programmatic parsing of the input data (e.g. NumberFormatException)

    env-Web env-ClientServer env-Peer2Peer env-CommProtocol
Exploit
  1. Perform SQL Injection through the generated data access layer:

    An attacker proceeds to exploit a weakness in the generated data access methods that does not properly separate control plane from the data plan, or potentially a particular way in which developer might have misused the generated code, to modify the structure of the executed SQL queries and/or inject entirely new SQL queries.

    Attack Step Techniques

    IDAttack Step Technique DescriptionEnvironments
    1

    An attacker uses normal SQL injection techniques and adjusts them to reflect the type of data access layer generation framework used by the application.

    env-Web

    Outcomes

    IDTypeOutcome Description
    1Success
    Attacker achieves goal of unauthorized system access, denial of service, etc.
    2Failure
    Attacker unable to exploit SQL Injection vulnerability.
+ Attack Prerequisites
  • An application uses data access layer generated by an ORM tool or framework

  • An application uses user supplied data in queries executed against the database

  • The separation between data plane and control plane is not ensured, through either developer error or an underlying weakness in the data access layer code generation framework

+ Typical Severity

High

+ Typical Likelihood of Exploit

Likelihood: Low

+ Methods of Attack
  • Injection
  • Analysis
  • API Abuse
+ Examples-Instances

Description

When using Hibernate, it is possible to use the session.find() method to run queries against the database. This is an overloaded method that provides facilities to perform binding between the supplied user data and place holders in the statically defined query. However, it is also possible to use the session.find() method without using any of these query binding overloads, hence effectively concatenating the user supplied data with rest of the SQL query, resulting in a possibility for SQL injection. While the framework may provide mechanisms to use methods immune to SQL injections, it may also contain ways that are not immune that may be chosen by the developer.

+ Attacker Skills or Knowledge Required

Skill or Knowledge Level: Medium

Knowledge of general SQL injection techniques and subtleties of the ORM framework is needed

+ Resources Required

No specialized resources are required.

+ Probing Techniques

Description

Provide various input to the system in an attempt to induce an error that would reveal stack trace information about the ORM layer (if any) used

+ Solutions and Mitigations

Remember to understand how to use the data access methods generated by the ORM tool / framework properly in a way that would leverage the built-in security mechanisms of the framework

Ensure to keep up to date with security relevant updates to the persistence framework used within your application.

+ Attack Motivation-Consequences
ScopeTechnical ImpactNote
Integrity
Modify application data
Availability
DoS: crash / exit / restart
DoS: instability
Confidentiality
Read memory
Read application data
Confidentiality
Access_Control
Authorization
Gain privileges / assume identity
Confidentiality
Integrity
Availability
Execute unauthorized code or commands
Run Arbitrary Code
+ Relevant Security Requirements

Ensure that the ORM data access methods that are used by the application leverage parameter binding

+ Purposes
  • Exploitation
+ CIA Impact
Confidentiality Impact: HighIntegrity Impact: HighAvailability Impact: High
+ Technical Context
Architectural Paradigms
Client-Server
Frameworks
All
Platforms
All
Languages
All
+ References
[R.109.1] [REF-4] "OWASP Testing Guide". Testing for ORM Injection (OWASP-DV-007). v4 [DRAFT]. The Open Web Application Security Project (OWASP). <http://www.owasp.org/index.php/Testing_for_ORM_Injection>.
+ Content History
Submissions
SubmitterOrganizationDateComments
Evgeny LebanidzeCigital, Inc2009-01-12Initial core pattern content
Modifications
ModifierOrganizationDateCommentsSource
Sean BarnumCigital Federal, Inc.2009-04-20Refinement of pattern content
CAPEC Content TeamThe MITRE Corporation2013-12-18Updated Attack_PhasesInternal
CAPEC Content TeamThe MITRE Corporation2014-02-06Updated Attack_PhasesInternal
CAPEC Content TeamThe MITRE Corporation2014-04-10Updated Attack_PhasesInternal

Page Last Updated: April 10, 2014