Injection Flaws on Internet-Facing Applications

What this finding is

User-controlled input reaches an interpreter without adequate separation between code and data, on a code path reachable from the public internet. Beacon treats SQL injection, NoSQL injection, OS command injection, LDAP injection, and server-side template injection as one finding class because the exploitation economics and the remediation pattern are effectively identical.

Why it is Tier 1

Injection converts a request into arbitrary interpreter execution. In the database case that is usually direct bulk exfiltration; in the command and template cases it is remote code execution, which is initial access rather than mere data loss. Detection and exploitation are both fully automated by widely-distributed tooling, so the window between a vulnerability becoming reachable and it being exploited is short and shrinking.

How to detect it

1. 1Run authenticated and unauthenticated dynamic scanning against every internet-facing application, covering API endpoints as well as rendered forms.
2. 2Apply static analysis to identify string-concatenated queries and unsanitised interpreter calls, then confirm reachability before triaging.
3. 3Review ORM escape hatches — raw-query interfaces are where parameterisation is most often abandoned under deadline pressure.
4. 4Test paths that are frequently overlooked: search, export, sort and filter parameters, file-name handling, and webhook receivers.

How to remediate it

Steps are ordered. The first step is the one that reduces exposure fastest, which is not always the one that closes the finding.

1. 1Deploy a WAF rule as an immediate containment measure, and record it as containment rather than remediation — it buys hours, not closure.
2. 2Replace dynamic query construction with parameterised statements or prepared queries; this is the fix, and no amount of input filtering substitutes for it.
3. 3For OS command paths, invoke the target binary directly with an argument array rather than passing a constructed string to a shell.
4. 4Apply allowlist validation on structural elements that cannot be parameterised, such as table and column names in dynamic sorting.
5. 5Reduce the database account's privilege so that a future injection yields a narrower result, and review query logs for exploitation predating the fix.

How to verify the fix

Mappings

Other Tier 1 findings in Data Protection