Improving Web Application Security: Threats and - CGISecurity

Chapter 18: Securing Your Database Server 503SQLInjectionPasswordCrackingPerimeterFirewallWeb App VulnerabilitiesOver privileged accountsWeak input validationInternalFirewallNetworkEavesdroppingBrowserWeb AppSQLServerUnauthorizedExternal AccessNetwork VulnerabilitiesFailure to block SQL portsConfiguration VulnerabilitiesOver privileged service accountWeak permissionsNo certificateFigure 18.1Top database server threats and vulnerabilitiesThe next sections describe each of these threats and vulnerabilities.SQL InjectionWith a SQL injection attack, the attacker exploits vulnerabilities in your application’sinput validation and data access code to run arbitrary commands in the databaseusing the security context of the Web application.VulnerabilitiesVulnerabilities exploited by SQL injection include:● Poor input validation in your Web applications● Unsafe, dynamically constructed SQL commands● Over-privileged application logins to the database● Weak permissions that fail to restrict the application’s login to the databaseCountermeasuresTo counter SQL injection attacks:● Your application should constrain and sanitize input data before using it in SQLqueries.● Use type safe SQL parameters for data access. These can be used with storedprocedures or dynamically constructed SQL command strings. Using SQLparameters ensures that input data is subject to type and length checks and alsothat injected code is treated as literal data, not as executable statements in thedatabase.