I know that to prevent all or most SQL injection attacks that you should use parametrized queries. I've been using Hibernate for a while instead of hand writing my SQL statements. Are there any known attacks or research that is directed toward exploiting this layer?
No, you are not automatically safe.
SQL Injection can still exist.
From the OWASP page:
A note about SQL injection
Since it is the hot topic, I will address it now but discuss in detail later.
- Hibernate does not grant immunity to SQL Injection, one can misuse the api as they please.
- There is nothing special about HQL (Hibernates subset of SQL) that makes it any more or less susceptible.
- Functions such as createQuery(String query) and createSQLQuery(String query) create a Query object that will be executed when the call to commit() is made. If the query string is tainted you have sql injection. The details of these functions are covered later.
In addition to the other answers, one area where ORMs may not help, is where there is an Issue with the ORM code itself. For example there were a couple of issues with ActiveRecord in Rails some versions ago where the SQL injection was in the framework itself rather in user created code.
That said correctly using an ORM does make it much easier to avoid SQL injection, so it'd be a good strategy to persue, as opposed to hand crafting queries.
In this blog post there is a sample code using nHibernate's CreateSQLQuery that will be vulnerable to SQL injection, as well as an appropriate way of writing the same query using Parameterized query in your ORM framework to avoid injection. At the end of the day, no matter how you create SQL queries, using string concating or ORM to deal with input as objects and attributes, if you create dynamic queries, injected SQL code can get executed at the database. But if you parameterize it, you are telling the database a "Select" or "Insert" query is coming with these two inputs for example, and even if the inputs contain some SQL code, the database does not execute them.