zap tool showing security vulnerability but we can't find those vulnerability in our source code?

Question

vulnerability showing as:-

SQL Injection - SQLite

Method: GET

Parameter: query

Attack: ' | case randomblob(10000000) when not null then "" else "" end --

Evidence: The query time is controllable using parameter value [' | case randomblob(10000000) when not null then "" else "" end --], which caused the request to take [542] milliseconds, parameter value [' | case randomblob(100000000) when not null then "" else "" end --], which caused the request to take [900] milliseconds, when the original unmodified query with value [query] took [167] milliseconds.

SQL Injection - Oracle - Time Based

Method: GET

Parameter: query

Attack: field: [query], value [query and exists (SELECT UTL_INADDR.get_host_name('10.0.0.1') from dual union SELECT UTL_INADDR.get_host_name('10.0.0.2') from dual union SELECT UTL_INADDR.get_host_name('10.0.0.3') from dual union SELECT UTL_INADDR.get_host_name('10.0.0.4') from dual union SELECT UTL_INADDR.get_host_name('10.0.0.5') from dual) -- ]

Advanced SQL Injection - Oracle AND time-based blind

Method: GET

Parameter: query

Attack: query AND 2972=DBMS_PIPE.RECEIVE_MESSAGE(CHR(113)||CHR(65)||CHR(80)||CHR(114),5)

SQL Injection - MsSQL

Method: GET

Parameter: query

Attack: query WAITFOR DELAY '0:0:15' --

SQL Injection - Hypersonic SQL - Time Based

Method: GET

Parameter: query

Attack: field: [query], value ["; select "java.lang.Thread.sleep"(15000) from INFORMATION_SCHEMA.SYSTEM_COLUMNS where TABLE_NAME = 'SYSTEM_COLUMNS' and COLUMN_NAME = 'TABLE_NAME' -- ]

SQL Injection - PostgreSQL - Time Based

Method: GET

Parameter: query

Attack: field: [query], value [case when cast(pg_sleep(15) as varchar) > '' then 0 else 1 end]

SQL Injection - MySQL

Method: GET

Parameter: query

Attack: query / sleep(15)

Advanced SQL Injection - PostgreSQL > 8.1 stacked queries (comment)

Method: GET

Parameter: query

Attack: query;SELECT PG_SLEEP(5)--

Advanced SQL Injection - Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)

Method: GET

Parameter: query

Attack: Feb 2018;SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(105)||CHR(122)||CHR(102)||CHR(108),5) FROM DUAL--

Advanced SQL Injection - Microsoft SQL Server/Sybase time-based blind.

Method: GET

Parameter: query

Attack: query) WAITFOR DELAY CHAR(48)+CHAR(58)+CHAR(48)+CHAR(58)+CHAR(91)+CHAR(83)+CHAR(76)+CHAR(69)+CHAR(69)+CHAR(80)+CHAR(84)+CHAR(73)+CHAR(77)+CHAR(69)+CHAR(93) AND (1972=1972

All of our source code following the given Example:-

public interface UserRepository extends JpaRepository<User, Long> { @Query("select u from User u where u.firstname = :firstname or u.lastname = :lastname") User findByLastnameOrFirstname(@Param("lastname") String lastname, @Param("firstname") String firstname); }

Can you add the ZAP issue details? The fact that so many of the SQL based rules are reporting something makes it more likely that its a real problem and not a false positive. — Simon Bennetts, May 08 '18 at 10:36
Also, you can look on the history tab and view the request and response, This could help you understand why Zap report SQLi. — Omer Levi Hevroni, May 08 '18 at 11:19

score 3 · Answer 1 · answered May 08 '18 at 14:49

Pick one of the timebased attacks and rerun it - you can do that by rightclicking on the alert in ZAP and selecting 'Open/Resend with Request Editor'. Check to see how long the request took (its shown at the bottom of the dialog) - was it the same time (or a bit more) than the delay that the attack is using? If so try increasing the delay and resending - is it now taking the longer period of time?

If the time is being affected by the time specified in the attack then you will have an SQL injection vulnerability.

Why havnt I said anything about the source code you posted? Thats because I have no idea if thats all of the relevant code :)

You might also want to try using a static analyser on your code - it will probably show loads of false positives, but you can just focus on any SQL injection vulnerabilities it reports.

zap tool showing security vulnerability but we can't find those vulnerability in our source code?

1 Answers1