Share via

CGI Generic SQL injection (blind) vulnerabilty

vallee2018 331 Reputation points
2020-12-28T15:34:49.75+00:00

Hello,

We use Nessus Professional to scan for potential internal vulnerabilities on servers and PCs. Recently a potential CGI Generic SQL injection (blind) vulnerabilty was identified on a server. The output of the scan is below. The page showing the vulnerability shows the Port: 8080/tcp/www and the Host - ServerName, on which this application is installed. I am logging onto the server using domain credentials.

It is unclear how I would confirm if this is truly a vulnerability or a false positive. Nessus has referred me to the links, but I am not seeing how this would apply as the results are essentially pointing to logging onto the server, rather than a specific application.

Can anyone provide some guidance on how to address this?

Thanks,
Roger

Description

By sending specially crafted parameters to one or more CGI scripts hosted on the remote web server, Nessus was able to get a very different response, which suggests that it may have been able to modify the behavior of the application and directly access the underlying database.

An attacker may be able to exploit this issue to bypass authentication, read confidential data, modify the remote database, or even take control of the remote operating system.

Note that this script is experimental and may be prone to false positives.

Solution

Modify the affected CGI scripts so that they properly escape arguments.

See Also

http://www.securiteam.com/securityreviews/5DP0N1P76E.html
http://www.nessus.org/u?ed792cf5
http://projects.webappsec.org/w/page/13246963/SQL%20Injection

The output of the scan shows the following:
Using the GET HTTP method, Nessus found that :

  • The following resources may be vulnerable to blind SQL injection :
  • The 'parentPageName' parameter of the /Login.jsp CGI :

/Login.jsp?ajax=Y&accountID=free&password=&rememberMe=Y&rememberMeForDis
play=&userName=&paneType=&paneMessage=&paneBtnArrayButtons=&manual=false
&gotoURL=&parentPageName=Login.jsp'||'Y&accountID=free&password=&remembe
rMe=Y&rememberMeForDisplay=&userName=&paneType=&paneMessage=&paneBtnArra
yButtons=&manual=false&gotoURL=&parentPageName=Login.jsp

-------- output --------
HTTP/1.1 200 OK
-------- vs --------
HTTP/1.1 400 Bad Request

  • The 'password' parameter of the /Login.jsp CGI :

/Login.jsp?ajax=Y&accountID=free&parentPageName=Login.jsp&rememberMe=Y&r
ememberMeForDisplay=&userName=&paneType=&paneMessage=&paneBtnArrayButton
s=&manual=false&gotoURL=&password='||'Y&accountID=free&parentPageName=Lo
gin.jsp&rememberMe=Y&rememberMeForDisplay=&userName=&paneType=&paneMessa
ge=&paneBtnArrayButtons=&manual=false&gotoURL=&password=

-------- output --------
HTTP/1.1 200 OK
-------- vs --------
HTTP/1.1 400 Bad Request

  • The 'rememberMe' parameter of the /Login.jsp CGI :

/Login.jsp?ajax=Y&accountID=free&parentPageName=Login.jsp&password=&reme
mberMeForDisplay=&userName=&paneType=&paneMessage=&paneBtnArrayButtons=&
manual=false&gotoURL=&rememberMe=Y'||'Y&accountID=free&parentPageName=Lo
gin.jsp&password=&rememberMeForDisplay=&userName=&paneType=&paneMessage=
&paneBtnArrayButtons=&manual=false&gotoURL=&rememberMe=Y

-------- output --------
HTTP/1.1 200 OK
-------- vs --------
HTTP/1.1 400 Bad Request

  • The 'rememberMeForDisplay' parameter of the /Login.jsp CGI :

/Login.jsp?ajax=Y&accountID=free&parentPageName=Login.jsp&password=&reme
mberMe=Y&userName=&paneType=&paneMessage=&paneBtnArrayButtons=&manual=fa
lse&gotoURL=&rememberMeForDisplay='||'Y&accountID=free&parentPageName=Lo
gin.jsp&password=&rememberMe=Y&userName=&paneType=&paneMessage=&paneBtnA
rrayButtons=&manual=false&gotoURL=&rememberMeForDisplay=

-------- output --------
HTTP/1.1 200 OK
-------- vs --------
HTTP/1.1 400 Bad Request

  • The 'paneType' parameter of the /Login.jsp CGI :

/Login.jsp?ajax=Y&accountID=free&parentPageName=Login.jsp&password=&reme
mberMe=Y&rememberMeForDisplay=&userName=&paneMessage=&paneBtnArrayButton
s=&manual=false&gotoURL=&paneType='||'Y&accountID=free&parentPageName=Lo
gin.jsp&password=&rememberMe=Y&rememberMeForDisplay=&userName=&paneMessa
ge=&paneBtnArrayButtons=&manual=false&gotoURL=&paneType=

-------- output --------
HTTP/1.1 200 OK
-------- vs --------
HTTP/1.1 400 Bad Request

  • The 'paneMessage' parameter of the /Login.jsp CGI :

/Login.jsp?ajax=Y&accountID=free&parentPageName=Login.jsp&password=&reme
mberMe=Y&rememberMeForDisplay=&userName=&paneType=&paneBtnArrayButtons=&
manual=false&gotoURL=&paneMessage='||'Y&accountID=free&parentPageName=Lo
gin.jsp&password=&rememberMe=Y&rememberMeForDisplay=&userName=&paneType=
&paneBtnArrayButtons=&manual=false&gotoURL=&paneMessage=

-------- output --------
HTTP/1.1 200 OK
-------- vs --------
HTTP/1.1 400 Bad Request

  • The 'paneBtnArrayButtons' parameter of the /Login.jsp CGI :

/Login.jsp?ajax=Y&accountID=free&parentPageName=Login.jsp&password=&reme
mberMe=Y&rememberMeForDisplay=&userName=&paneType=&paneMessage=&manual=f
alse&gotoURL=&paneBtnArrayButtons='||'Y&accountID=free&parentPageName=Lo
gin.jsp&password=&rememberMe=Y&rememberMeForDisplay=&userName=&paneType=
&paneMessage=&manual=false&gotoURL=&paneBtnArrayButtons=

-------- output --------
HTTP/1.1 200 OK
-------- vs --------
HTTP/1.1 400 Bad Request

  • The 'manual' parameter of the /Login.jsp CGI :

/Login.jsp?ajax=Y&accountID=free&parentPageName=Login.jsp&password=&reme
mberMe=Y&rememberMeForDisplay=&userName=&paneType=&paneMessage=&paneBtnA
rrayButtons=&gotoURL=&manual=false'||'Y&accountID=free&parentPageName=Lo
gin.jsp&password=&rememberMe=Y&rememberMeForDisplay=&userName=&paneType=
&paneMessage=&paneBtnArrayButtons=&gotoURL=&manual=false

-------- output --------
HTTP/1.1 200 OK
-------- vs --------
HTTP/1.1 400 Bad Request

  • The 'gotoURL' parameter of the /Login.jsp CGI :

/Login.jsp?ajax=Y&accountID=free&parentPageName=Login.jsp&password=&reme
mberMe=Y&rememberMeForDisplay=&userName=&paneType=&paneMessage=&paneBtnA
rrayButtons=&manual=false&gotoURL='||'Y&accountID=free&parentPageName=Lo
gin.jsp&password=&rememberMe=Y&rememberMeForDisplay=&userName=&paneType=
&paneMessage=&paneBtnArrayButtons=&manual=false&gotoURL=

-------- output --------
HTTP/1.1 200 OK
-------- vs --------

HTTP/1.1 400 Bad Request

SQL Server
SQL Server
A family of Microsoft relational database management and analysis systems for e-commerce, line-of-business, and data warehousing solutions.
14,492 questions

3 answers

Sort by: Most helpful
Most helpful Newest Oldest
  1. Tom Phillips 17,751 Reputation points
    2020-12-28T16:50:50.357+00:00

    This is really a web site issue and nothing to do with SQL Server. This is telling you the injection attack did not return the expected error. It does not mean it actually worked or did anything.

    I suggest you read this and follow the links to fix your website scripts:

    https://www.tenable.com/plugins/nessus/42424

    Also:
    https://learn.microsoft.com/en-us/sql/relational-databases/security/sql-injection?view=sql-server-ver15

  2. Tom Phillips 17,751 Reputation points
    2020-12-28T20:12:21.03+00:00
    0 comments
  3. AmeliaGu-MSFT 14,001 Reputation points Microsoft External Staff
    2020-12-29T05:49:43.157+00:00

    Hi vallee,

    To secure an application against SQL injection, both PreparedStatements and stored procedures compile the SQL statement before the user input is added, making it impossible for user input to modify the actual SQL statement. Please refer to Blind SQL Injection and SQL Injection Prevention Cheat Sheet which might help.
    For the web application issue, you can open a thread on the ASP.NET forum so that people there will help you more effectively.

    Best Regards,
    Amelia

    If the answer is helpful, please click "Accept Answer" and upvote it.
    Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Your answer

Answers can be marked as Accepted Answers by the question author, which helps users to know the answer solved the author's problem.