0

I would like to know how a connection string injection attack is performed?

The connection string is a set of key/value pair separated by a semi-colon. They are used by the web applications to connect to the database.

If a web application creates a connection string using dynamic string concatenation, to connect to the database based on the input provided by the users, then that web application is vulnerable to the connection string injection attack.

Please explain how could an attacker utilize this opportunity to access data from the database and give me an example if possible.

2
  • Some context would be nice. Do you know what this attack is? Have you done any searching on your own?
    – schroeder
    Commented Jan 31, 2018 at 10:03
  • The connection string is a set of key/value pair separated by a semi-colon. They allow the web applications to connect to the database. If a web application creates a connection string using dynamic string concatenation, to connect to the database based on the input provided by the users, then that web application is vulnerable to the connection string injection attack. I searched and not getting a satisfied clarification, my doubt is how could an attaker utilize this opportunity to access data from the database.
    – Varun CK
    Commented Jan 31, 2018 at 10:15

1 Answer 1

4

Some database providers has the "last one wins" algorithm. So if there is a KEYWORD=VALUE pair which is found more than once in the connection string, the value associated with the LAST occurrence is used.

So in a web application, If a user enters the username and password; a connection string is generated to connect to the back end database. For eg:

Data Source = myDataSource; Initial Catalog = db; Integrated Security = no; User ID = myUsername; Password = XXX;

After entering the username and password if the attacker adds something like

Intergrated Security = true;

the string becomes

Data Source = myDataSource; Initial Catalog = db; Integrated Security = no; User ID = myUsername; Password = XXX; Intergrated Security = true;

now here Intergrated Security = no; is overridden by Intergrated Security = true; by the "last one wins" principle.

The web application will then connect to the database using the operating system account under which the application is running to bypass normal authentication.

0

Not the answer you're looking for? Browse other questions tagged .