search

forcedotcom / SalesforceMobileSDK-iOS

iOS SDK for Salesforce
Other
537 stars 419 forks source link

DAST Review: SOQL query exposed in a Request #3718

Closed StarrySite closed 4 months ago

StarrySite commented 4 months ago

Please fill out the following details:

  1. Version of Mobile SDK Used: 11.1.0
  2. Issue found in Native App or Hybrid App: Native
  3. OS Version: All iOS
  4. Device: All type of iPhone devices
  5. Steps to reproduce: Sending SOQL web service request to Salesforce
  6. Actual behavior: The application leaks information like the SQL query and Ajax debug shell path.
  7. Expected Behavior: Never reveal a SQL query in the request or response.​ Do not expose the Ajax debug shell path to public users.
  8. Error Log:

We are using MobileSync and SalesforceRest API services for communicating with SF backend. Our application went through the Dynamic Application Security Test (DAST). The team noted the issue of exposing SOQL queries in web service request with the following impact.

"When an application discloses SQL queries, it exposes information about its database technology. This includes details about the database management system (DBMS) being used. It may be possible for an attacker to access the Ajax debug shell to execute malicious XSS payloads."

Please let us know whether we have any mechanism in Salesforce SDK to prevent this issue. or Let us know how the security is ensured when using Salesforce SDK.

wmathurin commented 4 months ago

SQOL is not SQL: it does not give you information about the physical DBMS that Salesforce uses. Instead it gives a view of the records and fields the user it authorized to view. The request needs to be authorized .

Requests to the SOQL query API end point must have an authorization header. The Mobile SDK takes care of adding the access token it got during login or refresh flow to outgoing requests. Without it, a request gets a 401 from the server. Mobile SDK also takes care of encrypting the tokens at rest.

The access token could be intercepted if you have physical access to a rooted / unlocked device or by doing a Man-In-The-Middle attack. There are ways to protect against those scenarios but there are outside the scope of the Mobile SDK (but there are available as part of enhanced security for Salesforce Mobile App).

Here is a paper discussing the security in the Salesforce Mobile App. Salesforce Mobile App is built on top of Mobile SDK so a lot of what the paper covers actually comes from the Mobile SDK and is therefore applicable to you.

I hope that helped. Let us know if you have any more questions.

StarrySite commented 4 months ago

@wmathurin Thanks a lot for the information. I will look into the documentation and let you know for any issues.