McAfee Research Blog

Web Application Vulnerabilities Can Make The Difference - How To Tackle The Threat

Automated SQL injection attacks against Websites have truely changed the Web threat-landscape this year. Attack toolkits misuse search engines to query for vulnerable Web pages. One reason why such attacks remain so successful is that it’s not based on a common Web server vulnerability that could simply be patched. Rather, the attacks work due to security flaws in various wide-spread Web applications that, on some pages, do not sufficiently verify user input submitted via Web forms or URL parameters. Commonly deployed Web applications include Content Management Systems, Weblog and Internet Forum systems.

Such a flaw’s result usually is that a SQL statement can be passed in through some unverified URL parameter or HTTP POST upload, and is then executed on the Web application side due to missing verification or normalization. Executing the SQL statement usually leads to injection of malicious script code into database tables where the HTML content of dynamically generated Web pages is stored.

Yet SQL injection is not the only type of vulnerability that can lead to a Website’s compromise. One recent example would be an authentication bypass vulnerability discovered in the popular open-source Content Management System Joomla!. The vulnerability allows an attacker to reset the password of the installation’s first user account, usually an Administrator - and afterwards the attacker can log into the system and perform malicious acts such as including malicious code into the legit pages.

It’s most important for Website administrators to assess what Web applications are installed on their servers, stay up-to-date with what vulnerabilities have been discovered in those systems lately and apply patches as soon as they are provided by the vendor. Can premature patches break some (legacy) functionality in the Web application? Maybe it can, but not applying the patch, on a system facing the Internet, will sooner or later break much more. An infected Website not only serves malware to your visitors, it also leads to confidence loss by your visitors and customers of your business. As a proactive measure against common attacks such as SQL injection, placing an application-aware Firewall with an Intrusion Prevention System in front of your Web server can save you a lot of trouble.

Home users and administrators of corporate user PCs need to ensure that Anti-Malware software is in place and kept current. Sounds like old news? Yes, but the continuing prevalence of the old NetSky worm, as well as the continuing exploitation of 2006’s MDAC vulnerability (MS06-014), underline that still too many users are suicidally surfing the Web without proper protection in place. Also, assess what kinds of third-party applications are installed - are the versions of Flash Player, Adobe Reader, QuickTime, Java and others up-to-date? And are they kept up-to-date? Attackers are increasingly attacking vulnerabilities in these applications as well.

Back to McAfee Research Blog overview