An attacker leverages a weakness present in the database access layer code
generated with an Object Relational Mapping (ORM) tool or a weakness in the
way that a developer used a persistence framework to inject his or her own
SQL commands to be executed against the underlying database. The attack here
is similar to plain SQL injection, except that the application does not use
JDBC to directly talk to the database, but instead it uses a data access
layer generated by an ORM tool or framework (e.g. Hibernate). While most of
the time code generated by an ORM tool contains safe access methods that are
immune to SQL injection, sometimes either due to some weakness in the
generated code or due to the fact that the developer failed to use the
generated access methods properly, SQL injection is still possible.
Attack Execution Flow
Explore
Determine Persistence Framework
Used:
An attacker tries to determine what persistence
framework is used by the application in order to
leverage a weakness in the generated data access
layer code or a weakness in a way that the data
access layer may have been used by the
developer.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
An attacker provides input to the
application in an attempt to induce an error
screen that reveals a strack trace that gives an
indication of the automated data access layer
used. Or an attacker may simply make some educated
guesses and assume, for instance, that Hibernate
is used and try to craft an attack from
there.
env-Web
Probe for ORM Injection
vulnerabilities:
The attacker injects ORM syntax into
user-controllable data inputs of the application to
determine if it is possible modify data query
structure and content.
Perform SQL Injection through the
generated data access layer:
An attacker proceeds to exploit a weakness in the
generated data access methods that does not properly
separate control plane from the data plan, or
potentially a particular way in which developer
might have misused the generated code, to modify the
structure of the executed SQL queries and/or inject
entirely new SQL queries.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
An attacker uses normal SQL injection
techniques and adjusts them to reflect the type of
data access layer generation framework used by the
application.
env-Web
Outcomes
ID
Type
Outcome Description
1
Success
Attacker achieves goal of
unauthorized system access, denial of service,
etc.
2
Failure
Attacker unable to exploit SQL
Injection vulnerability.
Attack Prerequisites
An application uses data access layer generated by an ORM tool or
framework
An application uses user supplied data in queries executed against the
database
The separation between data plane and control plane is not ensured,
through either developer error or an underlying weakness in the data access
layer code generation framework
Typical Likelihood of Exploit
Likelihood: Low
Methods of Attack
Injection
Analysis
API Abuse
Examples-Instances
Description
When using Hibernate, it is possible to use the session.find() method
to run queries against the database. This is an overloaded method that
provides facilities to perform binding between the supplied user data
and place holders in the statically defined query. However, it is also
possible to use the session.find() method without using any of these
query binding overloads, hence effectively concatenating the user
supplied data with rest of the SQL query, resulting in a possibility for
SQL injection. While the framework may provide mechanisms to use methods
immune to SQL injections, it may also contain ways that are not immune
that may be chosen by the developer.
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Medium
Knowledge of general SQL injection techniques and subtleties of the
ORM framework is needed
Resources Required
No specialized resources are required.
Probing Techniques
Description
Provide various input to the system in an attempt to induce an error
that would reveal stack trace information about the ORM layer (if any)
used
Solutions and Mitigations
Remember to understand how to use the data access methods generated by the
ORM tool / framework properly in a way that would leverage the built-in
security mechanisms of the framework
Ensure to keep up to date with security relevant updates to the
persistence framework used within your application.
Description
