WhiteSource SAST Vulnerability (Risk: High, Type: SQL Injection)

WhiteSource SAST Finding (Java-Demo-main-48a3a695997115c25a509e8dc87babd51d966492): Vulnerability Type: SQL Injection Vulnerable Sink Call: rs = stmt.executeQuery("SELECT name, secret FROM users WHERE ispublic = 'true' AND name='" + name + "' AND password='" + password + "'"); Input Source: getParameter Vulnerable Project File: src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java Function Call Stack: 0 - stmt.executeQuery (Line: 69) - src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java 1 - selectUsers (Line: 45) - src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java

User Input Flow: 0 - getParameter (Line: 28) - src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java 1 - password (Line: 28) - src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java 2 - name (Line: 39) - src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java 3 - name (Line: 45) - src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java 4 - name (Line: 60) - src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java 5 - name (Line: 69) - src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java

Description: Tainted input "getParameter" was received in line 28 of the file src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java:

String password = StringUtils.trim(req.getParameter("password"));

the value is then passed on to the value of "password" in line 28 of the file src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java

String password = StringUtils.trim(req.getParameter("password"));

which is further passed on to the value of "name" in line 39 of the file src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java

bodyHtml.append("<input type=\"password\" name=\"password\" size=\"20\" maxlength=\"20\" autocomplete=\"off\">");

which is further passed on to the value of "name" in line 45 of the file src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java

bodyHtml.append(selectUsers(name, password, req));

which is further passed on to the value of "name" in line 60 of the file src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java

private String selectUsers(String name, String password, HttpServletRequest req) {

which is further passed on to the value of "name" in line 69 of the file src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java

rs = stmt.executeQuery("SELECT name, secret FROM users WHERE ispublic = 'true' AND name='" + name

and finally passed unsanitized into a sensitive sink function "stmt.executeQuery" in line 69 of the file src/main/java/org/t246osslab/easybuggy/vulnerabilities/SQLInjectionServlet.java, causing a High risk SQL Injection vulnerability:

rs = stmt.executeQuery("SELECT name, secret FROM users WHERE ispublic = 'true' AND name='" + name

Mitigation Recommendations:

Using prepared statements (with parameterized queries)
Correct filtering (escaping) of string literal escape characters in SQL statements, like single quote ('), double quote ("), backslash () and the NULL byte
Checking parameters for valid representation for the give type (integer, float or boolean)
Correct database permissions on logon, which restricts web application or user access to unnecessary data

Further Reading:

Mend-Demo-GMS / Java-Demo

WhiteSource SAST Vulnerability (Risk: High, Type: SQL Injection) #29