49 lines
1.4 KiB
Plaintext
49 lines
1.4 KiB
Plaintext
Some Oracle packages contain powerful SYS-owned functions that can be used to perform malicious operations. For instance, ``++DBMS_SYS_SQL.PARSE_AS_USER++`` can be used to execute a statement as another user.
|
|
|
|
|
|
Most programs do not need those functions and this rule helps identify them in order to prevent security risks.
|
|
|
|
|
|
== Noncompliant Code Example
|
|
|
|
[source,sql]
|
|
----
|
|
DECLARE
|
|
c INTEGER;
|
|
sqltext VARCHAR2(100) := 'ALTER USER system IDENTIFIED BY hacker'; -- Might be injected by the user
|
|
BEGIN
|
|
c := SYS.DBMS_SYS_SQL.OPEN_CURSOR(); -- Noncompliant
|
|
|
|
-- Will change 'system' user's password to 'hacker'
|
|
SYS.DBMS_SYS_SQL.PARSE_AS_USER(c, sqltext, DBMS_SQL.NATIVE, UID); -- Non-Compliant
|
|
|
|
SYS.DBMS_SYS_SQL.CLOSE_CURSOR(c); -- Noncompliant
|
|
END;
|
|
/
|
|
----
|
|
|
|
|
|
== See
|
|
|
|
* https://owasp.org/Top10/A04_2021-Insecure_Design/[OWASP Top 10 2021 Category A4] - Insecure Design
|
|
* https://cwe.mitre.org/data/definitions/269.html[MITRE, CWE-269] - Improper Privilege Management
|
|
* https://cwe.mitre.org/data/definitions/270.html[MITRE, CWE-270] - Privilege Context Switching Error
|
|
|
|
|
|
ifdef::env-github,rspecator-view[]
|
|
|
|
'''
|
|
== Implementation Specification
|
|
(visible only on this page)
|
|
|
|
include::message.adoc[]
|
|
|
|
include::parameters.adoc[]
|
|
|
|
'''
|
|
== Comments And Links
|
|
(visible only on this page)
|
|
|
|
include::comments-and-links.adoc[]
|
|
endif::env-github,rspecator-view[]
|