CAPEC-109: Object Relational Mapping Injection

MITRE CAPEC attack pattern

Description

An attacker leverages a weakness present in the database access layer code generated with an Object Relational Mapping (ORM) tool or a weakness in the way that a developer used a persistence framework to inject their own SQL commands to be executed against the underlying database. The attack here is similar to plain SQL injection, except that the application does not use JDBC to directly talk to the database, but instead it uses a data access layer generated by an ORM tool or framework (e.g. Hibernate). While most of the time code generated by an ORM tool contains safe access methods that are immune to SQL injection, sometimes either due to some weakness in the generated code or due to the fact that the developer failed to use the generated access methods properly, SQL injection is still possible.

Where this sits in the chain

A finding maps to a weakness (CWE), a weakness is exploited by an attack pattern (CAPEC), and an attack pattern shows up in ATT&CK as observed adversary behaviour. This page is the middle hop.

Weaknesses exploited: CWE-20, CWE-89, CWE-564

Prerequisites

• An application uses data access layer generated by an ORM tool or framework
• An application uses user supplied data in queries executed against the database
• The separation between data plane and control plane is not ensured, through either developer error or an underlying weakness in the data access layer code generation framework

Skills required

• Medium: Knowledge of general SQL injection techniques and subtleties of the ORM framework is needed

Consequences

• Integrity: Modify Data
• Availability: Unreliable Execution
• Confidentiality: Read Data
• Confidentiality, Access Control, Authorization: Gain Privileges
• Confidentiality, Integrity, Availability: Execute Unauthorized Commands

Mitigations

• Remember to understand how to use the data access methods generated by the ORM tool / framework properly in a way that would leverage the built-in security mechanisms of the framework
• Ensure to keep up to date with security relevant updates to the persistence framework used within your application.

Source

• MITRE CAPEC CAPEC-109