Skip to content

Latest commit

 

History

History
83 lines (70 loc) · 6.53 KB

threat-modeling.md

File metadata and controls

83 lines (70 loc) · 6.53 KB

Threat Model Analysis for aspnet/entityframeworkcore

Threat: SQL Injection via Raw SQL Queries

  • Threat: SQL Injection via Raw SQL Queries

    • Description: An attacker provides malicious input to a raw SQL query (using FromSqlRaw or ExecuteSqlRaw) that is not properly parameterized. The attacker crafts the input to alter the intended SQL command, potentially extracting data, modifying data, or executing arbitrary commands on the database server. This is a direct misuse of EF Core's raw SQL execution capabilities.
    • Impact:
      • Data breach (confidentiality violation).
      • Data modification or deletion (integrity violation).
      • Database server compromise.
      • Complete application takeover.
    • Affected EF Core Component:
      • FromSqlRaw method.
      • ExecuteSqlRaw method.
      • ExecuteSqlRawAsync method.
      • Any custom methods that execute raw SQL using EF Core's connection.
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Always use parameterized queries with FromSqlRaw and ExecuteSqlRaw. Use the DbParameter class or the overload that accepts an object[] parameters argument. Never directly concatenate user input into the SQL string.
      • Input Validation: Validate all user input before passing it to any database-related function, even if using parameterized queries (defense in depth). This is a general best practice, but crucial here.
      • Least Privilege: Ensure the database user account used by the application has the minimum necessary privileges. Avoid using accounts with administrative rights.
      • Static Analysis: Use static code analysis tools to detect potential SQL injection vulnerabilities.

Threat: SQL Injection via String Interpolation in LINQ

  • Threat: SQL Injection via String Interpolation in LINQ

    • Description: An attacker provides malicious input that is used within a LINQ query via string interpolation (e.g., context.Blogs.Where(b => b.Name == "${userInput}")). Although EF Core normally parameterizes LINQ queries, string interpolation bypasses this protection, creating a direct SQL injection vulnerability. This is a direct misuse of how LINQ should interact with EF Core.
    • Impact: (Same as above - SQL Injection)
      • Data breach (confidentiality violation).
      • Data modification or deletion (integrity violation).
      • Database server compromise.
      • Complete application takeover.
    • Affected EF Core Component:
      • LINQ to Entities provider (when misused with string interpolation).
      • IQueryable<T> interface (when misused).
    • Risk Severity: Critical
    • Mitigation Strategies:
      • Never use string interpolation directly within LINQ queries. Use standard LINQ syntax and let EF Core handle parameterization automatically. For example, use context.Blogs.Where(b => b.Name == userInput).
      • Input Validation: Validate all user input before using it in any part of the application, including LINQ queries.
      • Code Reviews: Conduct thorough code reviews to ensure that string interpolation is not used within LINQ queries.

Threat: Inefficient Query Leading to Denial of Service (DoS)

  • Threat: Inefficient Query Leading to Denial of Service (DoS)

    • Description: An attacker crafts a request that triggers a poorly written LINQ query, resulting in an extremely inefficient SQL query. This query consumes excessive database resources (CPU, memory, I/O), causing slow performance or even crashing the database server, leading to a denial of service. This often involves exploiting N+1 query problems or loading excessively large datasets through EF Core's query generation. This is a direct consequence of how EF Core translates LINQ to SQL.
    • Impact:
      • Application slowdown or unavailability.
      • Database server overload.
      • Resource exhaustion.
    • Affected EF Core Component:
      • LINQ to Entities provider.
      • IQueryable<T> interface (when misused).
      • Eager loading (Include) (when misused).
    • Risk Severity: High
    • Mitigation Strategies:
      • Query Optimization: Carefully review and optimize LINQ queries. Use tools like SQL Profiler or EF Core's logging to analyze generated SQL and identify performance bottlenecks.
      • Avoid N+1 Queries: Use eager loading (Include) judiciously and appropriately. Use projections (Select) to fetch only the necessary data.
      • Pagination: Implement pagination to limit the amount of data retrieved in a single request.
      • AsNoTracking: Use AsNoTracking() for read-only queries to reduce the overhead of change tracking.
      • Use IQueryable Effectively: Leverage IQueryable to defer query execution to the database server and apply filtering and sorting on the server side.
      • Timeout: Set reasonable timeout for database operations.

Threat: Sensitive Data Leakage in Logs

  • Threat: Sensitive Data Leakage in Logs

    • Description: EF Core is configured to log SQL queries and parameter values, and sensitive data (e.g., passwords, credit card numbers) is included in these logs because of EF Core's logging configuration. An attacker gains access to the logs and extracts the sensitive information. This is a direct result of how EF Core's logging is set up.
    • Impact:
      • Information disclosure (confidentiality violation).
      • Data breach.
    • Affected EF Core Component:
      • DbContext.Database.Log (when misconfigured).
      • Logging configuration for EF Core.
    • Risk Severity: High
    • Mitigation Strategies:
      • Configure Logging Carefully: Configure EF Core's logging to exclude sensitive data. Avoid logging raw SQL queries with parameter values in production.
      • Use Parameterized Queries: (Always!) This helps prevent sensitive data from appearing directly in logged SQL queries.
      • Sensitive Data Masking: Implement mechanisms to mask or redact sensitive data in logs.
      • Secure Log Storage: Store logs securely and protect them from unauthorized access.