Black Hat DC: Researchers Reveal Connection String 'Pollution' Attack
Tool released tests for so-called Connection String Parameter Pollution (CSPP) attack
February 2, 2010
![](https://eu-images.contentstack.com/v3/assets/blt6d90778a997de1cd/bltc94608acf452fd67/655cf371ab171e040a838b2a/329050_DR23_Graphics_Website_V5_Default_Image_v1.png?width=1280&auto=webp&quality=95&format=jpg&disable=upscale)
WASHINGTON, DC -- Black Hat DC 2010 -- A pair of Spanish researchers here today demonstrated a way to hack the connection between a Web application and a database, letting the attacker hijack Web credentials and perform other nefarious activities.
The so-called Connection String Parameter Pollution (CSPP) attack exploits poorly secured dynamic connections between Web apps and databases, namely ones that still use semicolons as separators between data such as the data source, user ID, and password associated with a connection to the database, for instance. "If an attacker pollutes the parametershe will have full control of the connection string and can overwrite anything in it," says Jose Palazon, a researcher with Informatica 64, who along with colleague Chema Alonso demonstrated the CSPP attack.
Palazon and Alonso say CSPP lets an attacker steal hashes and scan ports on a server as well. They also released a tool today called CSPP Scanner that allows organizations to test whether they are vulnerable to this form of attack.
CSPP basically injects or pollutes connection strings between the Web application authenticating a user to the database, for example, by injecting phony parameters into the connection strings using semicolons as separators, which allows the attacker to take over the application and the way it's authenticated, the researchers say.
This type of attack is easy to execute, they say, and thus likely to be exploited.
Among the products the researchers were able to wage CSPP attacks against are ASP.NET Enterprise Manager and myLittleAdmin, which they demonstrated today. Oracle's software is also susceptible to these attacks in Windows and Linux environments, according to the researchers.
The ConnectionStringBuilder feature in Microsoft .NET Framework 2.0 is safe from Connection String Parameter Pollution attacks because you can't inject into its connection string.
"All the application vendors [here] have been notified" about these attacks, Alonso says, and they have issued patches.
So how do you defend against a CSPP attack? "Harden your firewall," Alonso says. "[Ensure] that every outbound connection is the one you want. You don't want your application server making [unauthorized] outbound connections."
Other ways to counter these attacks is to review and harden your internal accounts and policies, including that of your Web application server, Web server, and database. And deploy ConnectionStringBuilder, the researcher say. "And filter the semicolon," Alonso says.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author
You May Also Like
Catch the Threat Before it Catches you: Proactive Ransomware Defense
September 5, 2024How to Evaluate Hybrid-Cloud Network Policies and Enhance Security
September 18, 2024DORA and PCI DSS 4.0: Scale Your Mainframe Security Strategy Among Evolving Regulations
September 26, 2024Harnessing the Power of Automation to Boost Enterprise Cybersecurity
October 3, 2024
[Virtual Event] The Essential Guide to Cloud Management
October 17, 2024Black Hat Europe - December 9-12 - Learn More
December 10, 2024SecTor - Canada's IT Security Conference Oct 22-24 - Learn More
October 22, 2024