SQL Injection Attacks and Defense - 2009

Platform-Level Defenses • Chapter 9 409
encrypted e-mail, to provide this file to trusted partners who may need this information to
communicate with the Web service.
Increase the Verbosity of Web Server Logs
Web server log files can provide some insight into potential SQL injection attacks, especially
when application logging mechanisms are below par. If the vulnerability is in a URL parameter,
you are lucky as Apache and IIS log this information by default. If you’re defending a Web
application that has poor logging facilities, consider also configuring your Web server to log
the Referer and Cookie headers. This will increase the size of the log file, but provides
potential security benefits with insight into Cookie and Referer headers, which are another
potential location for SQL injection vulnerabilities to materialize. Both Apache and IIS
require the installation of addition modules to log POST data. Refer to “Using Runtime
Protection” for techniques and solutions to add monitoring and intrusion detection facilities
to your Web application.
Deploy the Web and
Database Servers on Separate Hosts
You should avoid running the Web and database server software on the same host.
This significantly increases the attack surface of the Web application and may expose the
database server software to attacks that previously were not possible given access to the Web
front end only. For example, the Oracle XML Database (XDB) exposes an HTTP server
service on Transmission Control Protocol (TCP) port 8080. This is now an additional entry
point for probing and potential injection. Additionally, the attacker could leverage this
deployment scenario to write query results to a file in a Web-accessible directory and view
the results in the Web browser.
Configure Network Access Control
In networks that are properly layered, database servers are typically located on internal
trusted networks. Usually this segregation is beneficial to thwart network-based attacks;
however, this trusted network can be breached via an SQL injection vulnerability in an
Internet-facing Web site. With direct access to the database server, the attacker can attempt
to connect to other systems on the same network. Most database server platforms offer one
or more ways for initiating network connections. Given this, consider implementing network
access control that restricts connections to other systems on the internal network. You can
do this at the network layer with firewall and router ACLs or by using a host-level mechanism
such as IPSec. Additionally, ensure that proper network access controls are in place to prevent
outbound network connections. This can be leveraged by an attacker to tunnel database
results via an alternative protocol such as DNS or the database server’s own network protocol.