The Essence of Command Injection Attacks in Web Applications

Web applications typically interact with a back-end database to re-trieve persistent data and then present the data to the user as dy-namically generated output, such as HTML web pages. However, this interaction is commonly done through a low-level API by dy-namically constructing query strings within a general-purpose pro-gramming language, such as Java. This low-level interaction is ad hoc because it does not take into account the structure of the output language. Accordingly, user inputs are treated as isolated lexical entities which, if not properly sanitized, can cause the web applica-tion to generate unintended output. This is called a command injec-tion attack, which poses a serious threat to web application security. This paper presents the first formal definition of command injec-tion attacks in the context of web applications, and gives a sound and complete algorithm for preventing them based on context-free grammars and compiler parsing techniques. Our key observation is that, for an attack to succeed, the input that gets propagated into the database query or the output document must change the in-tended syntactic structure of the query or document. Our definition and algorithm are general and apply to many forms of command injection attacks. We validate our approach with SQLCHECK, an implementation for the setting of SQL command injection attacks. We evaluated SQLCHECK on real-world web applications with sys-tematically compiled real-world attack data as input. SQLCHECK produced no false positives or false negatives, incurred low run-time overhead, and applied straightforwardly to web applications written in different languages