Hi Checkmates,
long post - grateful if you could help me with this one:
For a demonstration, I created a small web/DB application intentionally vulnerable to SQL injection and ran sqlmap (a standard tool for pen testing sql injections) against it.
Traffic (plain HTTP on port 80) was routed through a CheckPoint R81.20 with IDP enabled using the "strict" profile.
To my surprise, the sql injection still worked and sqlmap was able to enumerate and dump the complete database.
Sqlmap used several dozens very obvious SQL injection attempts. The firewall logged and passed all of them, without preventing or noticing the SQL injection attack - with one exception:
The protection "Sqlmap Automated SQL Injection Tool" fired once, and only once.
This did not prevent the other requests, and did not stop the extraction of the data base.
Now, did I miss something in configuring the firewall IDP, or do the protections simply not protect against sqlmap?
On the firewall, I checked:
- IPS, Anti-Bot, Anti-Virus Blades are enabled:
# enabled_blades
fw av ips anti_bot
- IDP is enabled, pattern are up-to-date, firewall is using the "Strict"-Profile:
# ips stat
IPS Status: Enabled
Active Profiles:
Strict
IPS Update Version: 635256678
Global Detect: Off
Bypass Under Load: Off
- IPS bypass under load is diabled:
# ips bypass stat
IPS Bypass Under Load: Disabled
- The target network 172.20.11.0/24 is in the "Protected Scope" (Security Policies / Threat Prevention / Custom Policy)
- There are no exceptions to the IDP protections (Manage & Settings / Blades / General / Inspection Settings / Exceptions)
- There are no exceptions in the Threat Prevention Policy (Security Policies / Threat Prevention / Exceptions)
- Assigned Inspection Profile is "Recommended Inspections" (Manage & Settings / Blades / General / Inspection Settings / Gateways)
- Topology for firewall interfaces is set:
- eth1 (towards attacker/sqlmap) is "External"
- eth2 (towards vulnerable application) is "Defined by routes (Internal)"
- IPS Activation Mode is "According to Policy", not "Detect only" (Gateways / "firewall" / IPS)
- Installing the Threat Prevention Policy gives no warnings.
Here is an example of a successful sqlmap command:
sqlmap --batch \
--flush-session \
--dump \
-D mydb_name \
-T admins \
--headers="Content-Type: application/json" \
-u http://172.20.11.11/search \
--random-agent \
--data='{"text1":"*", "andor":"and", "text2":""}'
The vulnerability is in an unchecked JSON parameter ("text1") sent as a POST request) to /search.
An example of a sqlmap request the firewall lets pass is this:
POST /search HTTP/1.1
Content-Length: 85
Content-Type: application/json
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.6 Safari/605.1.15
Host: 172.20.11.11
Accept: */*
Accept-Encoding: gzip,deflate
Connection: close
{"text1":";SELECT DBMS_PIPE.RECEIVE_MESSAGE(CHR(106)||CHR(74)||CHR(109)||CHR(86),5) FROM DUAL--", "andor":"and", "text2":""}
What else can I check to find out why the sql injection is not blocked - any thoughts?
