An attacker modifies the parameters of the SOAP message that is sent from
the service consumer to the service provider to initiate a SQL injection
attack. On the service provider side, the SOAP message is parsed and
parameters are not properly validated before being used to access a database
in a way that does not use parameter binding, thus enabling the attacker to
control the structure of the executed SQL query. This pattern describes a
SQL injection attack with the delivery mechanism being a SOAP
message.
Attack Execution Flow
Explore
Detect Incorrect SOAP Parameter
Handling:
The attacker tampers with the SOAP message
parameters and looks for indications that the
tampering caused a change in behavior of the
targeted application.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
The attacker tampers with the SOAP message
parameters by injecting some special characters
such as single quotes, double quotes, semi
columns, etc. The attacker observes system
behavior.
env-Web
Indicators
ID
Type
Indicator Description
Environments
1
Positive
SOAP messages are used as a communication
mechanism in the system
env-Web
Outcomes
ID
Type
Outcome Description
1
Success
Any indication that the
injected input is causing system trouble (e.g.
stack traces are produced, the system does not
respond, etc.) then the attacker may come to
conclude that the system is vulnerable to SQL
injection through SOAP parameter
tampering.
Experiment
Probe for SQL Injection
vulernability:
The attacker injects SQL syntax into vulnerable
SOAP parameters identified during the Explore phase
to search for unfiltered execution of the SQL syntax
in a query.
At least one SOAP parameter
susceptible to injection
found.
2
Failure
No SOAP parameter susceptible
to injection found.
Security Controls
ID
Type
Security Control Description
1
Detective
Search for and alert
on unexpected SQL keywords in application logs
(e.g. SELECT, DROP,
etc.).
2
Preventative
Input validation of
SOAP parameter data before including it in a SQL
query
3
Preventative
Use parameterized
queries (e.g. PreparedStatement in Java, and
Command.Parameters.Add() to set query parameters
in .NET)
Exploit
Inject SQL via SOAP
Parameters:
The attacker injects SQL via SOAP parameters
identified as vulnerable during Explore phase to
launch a first or second order SQL injection
attack.
Attack Step Techniques
ID
Attack Step Technique Description
Environments
1
An attacker performs a SQL injection attack
via the usual methods leveraging SOAP parameters
as the injection vector. An attacker has to be
careful not to break the XML parser at the service
provider which may prevent the payload getting
through to the SQL query. The attacker may also
look at the WSDL for the web service (if
available) to better understand what is expected
by the service provider.
env-Web
Outcomes
ID
Type
Outcome Description
1
Success
Attacker achieves goal of
unauthorized system access, denial of service,
etc.
2
Failure
Attacker unable to exploit SQL
Injection vulnerability.
Attack Prerequisites
SOAP messages are used as a communication mechanism in the system
SOAP parameters are not properly validated at the service provider
The service provider does not properly utilize parameter binding when
building SQL queries
Typical Likelihood of Exploit
Likelihood: High
Methods of Attack
Injection
Analysis
Examples-Instances
Description
An attacker uses a travel booking system that leverages SOAP
communication between the client and the travel booking service. An
attacker begins to tamper with the outgoing SOAP messages by modifying
their parameters to include characters that would break a dynamically
constructed SQL query. He notices that the system fails to respond when
these malicious inputs are injected in certain parameters transffered in
a SOAP message. The attacker crafts a SQL query that modifies his
payment amount in the travel system's database and passes it as one of
the parameters . A backend batch payment system later fetches the
payment amount from the database (the modified payment amount) and sends
to the credit card processor, enabling the attacker to purchase the
airfare at a lower price. An attacker needs to have some knowledge of
the system's database, perhaps by exploiting another weakness that
results in information disclosure.
Attacker Skills or Knowledge Required
Skill or Knowledge Level: Medium
If the attacker is able to gain good understanding of the system's
database schema; High: If the attacker has to perform SQL injection
blindly
Resources Required
No specialized hardware resources are required
Probing Techniques
Description
Inject SQL characters in SOAP parameters and observe system
behavior
Description
Review WSDL to understand what is expected by the service
provider
Solutions and Mitigations
Properly validate and sanitize/reject user input at the service
provider.
Ensure that prepared statements or other mechanism that enables parameter
binding is used when accessing the database in a way that would prevent the
attacker's supplied data from controlling the structure of the executed
query.
At the database level, ensure that the database user used by the
application in a particular context has the minimum needed privileges to the
database that are needed to perform the operation. When possible, run
queries against pregenerated views rather than the tables directly.
Description
