1

While Scanning a Asp.Net project got a error saying Access control Database,

It says

"Without proper access control, executing a SQL statement that contains a user-controlled primary key can allow an attacker to view unauthorized records."

Even though there is a proper validation for the input fields and the data is moved across layers ie., Front END(UI)->BUSINESS Layer->data layer.

Is there any property on the control or database to set so that the issue can be resolved

1
  • What is the Rule ID, Impact and Likelihood (found on the Detail tab)? How is the data validated? Are you using an ORM (nHibernate, LINQ, etc.)?
    – LaJmOn
    Commented Jan 13, 2012 at 17:04

2 Answers 2

5

"Access Control: Database" means a NUMERIC input data is received from the attacker, and provided to the query. It may be validated for format, like "be sure it is a positive integer", but the risk is that if the attacker has control of the value he can change the primary key of the query, getting different data back.

This is different from SQL Injection only in the sense that SQL Injection by convention means that the attacker changed the structure of the query (e.g. by adding keywords). But of course they are both injections of content into SQL.

"Is there a property on the control or database...?" No.

  1. To properly validate this data, you have to place an application level control so that you are sure the attacker is only providing the primary key he is allowed to add. You could do this for instance, by not giving the value at all to the remote client. You could perhaps just keep it in the session across requests.

  2. To properly resolve a completely legitimate issue: Select "Not an Issue" in the audit analysis or primary tag dropdown. Enter a comment, explaining to the security lead why you believe the logic is justified and safe. Submit the comment using the stupid submit button that should not be necessary.

  3. To properly resolve an entire class of legitimate issues: I commonly create a filter to hide Access Control:Database issues where the source of untrusted data was not the remote attacker but rather the database.

In this case, query 1 looks up "Jane Doe" and gets her foo ID. Query 2 looks in another place where ID = Jane's foo ID. The ID originated from the first database query. The data will carry a Fortify Taint Flag called "DATABASE". YOU AND YOUR SECURITY AUDITOR MAY TRUST THIS SOURCE OF INFORMATION. Or, it may be considered another place where hackers have stashed malicious data intended to enable subversion of your app. I wouldn't know.

In the case you and your security auditor trust the database, you can create a filter "if taint:database -> hide the issue" and then put this filter into the default filterset of your projects' template(s). You do this using Audit Workbench's Tools->Project Configuration... dialog.

1
  • I'm sorry my answer was so long. Access Control: Database is a really simple vulnerability pattern, but not so simple to apply the mitigation. Commented Jan 20, 2012 at 15:45
0

As long as it comes directly from user fortify warns you. Often it is false-positive. Fortify expects, user input have to be validated from another source like an array.

The other possibility to fix it, create a custom dll which contains a validation function for user inputs. Do not pass user parameters directly to the database layer. Validate these inputs by using your custom dll. That will %100 work.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.